# CVE-2025-29923: go-redis out-of-order responses when CLIENT SETINFO times out

Source: https://junglewise.ai/threats/cve-2025-29923-go-redis-out-of-order-responses-when-client-setinfo-times-out  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-03-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-29923 · Severity: low · CVSS 3.7 · Published 2025-03-20

Go-redis is a popular Redis client library for Go. During connection setup, the client may send a CLIENT SETINFO command that can timeout due to network issues or aggressive timeout settings. When this occurs, the client's response buffer becomes desynchronized, causing it to receive responses to the wrong commands. This can lead to data corruption or application logic errors, particularly in systems using sticky connections or pipelined commands.

Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Redis](https://junglewise.ai/threats/vendors/redis).

## Quick answers

**Is CVE-2025-29923 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-29923 being exploited in the wild.

**How severe is CVE-2025-29923?** Low severity, with a CVSS score of 3.7, published 20 March 2025.

**Which products and versions are affected?** github.com/redis/go-redis (Go) SEMVER:introduced=0; github.com/redis/go-redis/v7 (Go) SEMVER:introduced=0; github.com/redis/go-redis/v8 (Go) SEMVER:introduced=0; github.com/redis/go-redis/v9 (Go) SEMVER:introduced=9.5.1,fixed=9.5.5, SEMVER:introduced=9.7.0-beta.1,fixed=9.7.3; and 1 more.

**Is there a fix for CVE-2025-29923?** Yes. github.com/redis/go-redis/v9 (Go): upgrade to 9.5.5, 9.7.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-29923 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-29923?** Check whether you run github.com/redis/go-redis (Go), github.com/redis/go-redis/v7 (Go), github.com/redis/go-redis/v8 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/redis/go-redis/v9 (Go): upgrade to 9.5.5, 9.7.3 or later

  ```sh
  go get github.com/redis/go-redis/v9@v9.7.3
  ```


## Technical details

This vulnerability is a response ordering bug triggered when the CLIENT SETINFO command times out during Redis connection establishment. The root cause is improper handling of the read buffer when the identity-transmission handshake fails to complete within the configured timeout. The vulnerability requires specific preconditions: the client must be configured with identity transmission enabled (default), and either network connectivity issues or aggressive timeouts must occur. An attacker cannot directly trigger this but can exploit timing conditions to cause timeouts. The impact manifests differently based on connection pooling strategy: sticky connections receive persistent out-of-order responses for the connection lifetime, pipelined commands all receive mismatched responses, or pooled connections may be marked as bad after a single out-of-order response. Patches are available in versions 9.5.5, 9.6.3, and 9.7.3 (9.7.2 was yanked). A workaround exists: disable identity transmission by setting the DisableIndentity flag to true when constructing the client.

## Affected products

- Redis go-redis >= 9.5.1, < 9.5.5; >= 9.6.0-beta.1, < 9.6.3; >= 9.7.0-beta.1, <= 9.7.1

## Identifiers

- CVE-2025-29923
- GHSA-92cp-5422-2mw7
- GO-2025-3540

## Timeline

- 2025-03-20: disclosed: Vulnerability disclosed in GHSA-92cp-5422-2mw7
- 2025-03-20: patched: Patches released in versions 9.5.5, 9.6.3, and 9.7.3

## References

- [https://api.github.com/users/noren95](https://api.github.com/users/noren95)
- [https://github.com/noren95](https://github.com/noren95)
- [https://api.github.com/users/noren95/gists%7B/gist_id%7D](https://api.github.com/users/noren95/gists%7B/gist_id%7D)
- [https://api.github.com/users/noren95/repos](https://api.github.com/users/noren95/repos)
- [https://avatars.githubusercontent.com/u/114586487?v=4](https://avatars.githubusercontent.com/u/114586487?v=4)
- [https://api.github.com/users/noren95/events%7B/privacy%7D](https://api.github.com/users/noren95/events%7B/privacy%7D)