CVE-2025-49112
Quick assessment
Affected
Valkey Valkey
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Valkey是Valkey开源的一个灵活的分布式键值数据库。 Valkey 8.1.1及之前版本存在数字错误漏洞，该漏洞源于networking.c中的整数下溢，可能导致内存损坏。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-49112
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
setDeferredReply in networking.c in Valkey through 8.1.1 has an integer underflow for prev->size - prev->used.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
整数下溢(超界折返)
Source: CVE Program / CVE List V5
Vulnerability Title
Valkey 数字错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Valkey是Valkey开源的一个灵活的分布式键值数据库。 Valkey 8.1.1及之前版本存在数字错误漏洞，该漏洞源于networking.c中的整数下溢，可能导致内存损坏。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-49112
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-49112
请登录查看更多情报信息。
Patches & Fixes for CVE-2025-49112 (2)
IV. Related Vulnerabilities
Same product: Valkey
-
CVE-2026-63639
Valkey: UAF in stream deserialization may lead to remote cod -
CVE-2026-56684
Valkey: TLS pending-data processing use-after-free may allow -
CVE-2026-27623
Valkey has Pre-Authentication DOS from malformed RESP reques -
CVE-2026-21863
Malformed Valkey Cluster bus message can lead to Remote DoS -
CVE-2025-67733
Valkey Affected by RESP Protocol Injection via Lua error_rep
Same weakness: CWE-191
-
CVE-2026-16924
Vulnerabilities in IBM AIX and PowerVM VIOS -
CVE-2026-58087
Heap out-of-bounds access in semctl(2) -
CVE-2026-62289
libheif: Integer underflow in Fraction constructor via doubl -
CVE-2026-45698
Netatalk has Integer Underflow → Stack Buffer Overflow in de -
CVE-2026-45699
Netatalk has Integer Underflow → Stack Buffer Overflow in co
V. Comments for CVE-2025-49112
No comments yet