Redis 6.2.18 (#13971)

### Security fixes

* (CVE-2025-21605) An unauthenticated client can cause an unlimited
growth of output buffers

00-RELEASENOTES

@@ -11,6 +11,17 @@ CRITICAL: There is a critical bug affecting MOST USERS. Upgrade ASAP.
 SECURITY: There are security fixes in the release.
 --------------------------------------------------------------------------------
 
+================================================================================
+Redis 6.2.18    Released Wed 23 Apr 2025 12:00:00 IST
+================================================================================
+
+Update urgency: `SECURITY`: There are security fixes in the release.
+
+
+### Security fixes
+
+* (CVE-2025-21605) An unauthenticated client can cause an unlimited growth of output buffers
+
 
 ================================================================================
 Redis 6.2.17    Released Mon 6 Jan 2025 12:30:00 IDT

src/networking.c

@@ -3285,6 +3285,11 @@ int checkClientOutputBufferLimits(client *c) {
     int soft = 0, hard = 0, class;
     unsigned long used_mem = getClientOutputBufferMemoryUsage(c);
 
+    /* For unauthenticated clients the output buffer is limited to prevent
+     * them from abusing it by not reading the replies */
+    if (used_mem > 1024 && authRequired(c))
+        return 1;
+
     class = getClientType(c);
     /* For the purpose of output buffer limiting, masters are handled
      * like normal clients. */

src/version.h

@@ -1,2 +1,2 @@
-#define REDIS_VERSION "6.2.17"
-#define REDIS_VERSION_NUM 0x00060211
+#define REDIS_VERSION "6.2.18"
+#define REDIS_VERSION_NUM 0x00060212

tests/unit/auth.tcl

@@ -40,6 +40,24 @@ start_server {tags {"auth"} overrides {requirepass foobar}} {
         assert_match {*unauthenticated bulk length*} $e
         $rr close
     }
+
+    test {For unauthenticated clients output buffer is limited} {
+        set rr [redis [srv "host"] [srv "port"] 1 $::tls]
+        $rr SET x 5
+        catch {[$rr read]} e
+        assert_match {*NOAUTH Authentication required*} $e
+
+        # Fill the output buffer in a loop without reading it and make
+        # sure the client disconnected.
+        # Considering the socket eat some of the replies, we are testing
+        # that such client can't consume more than few MB's.
+        catch {
+            for {set j 0} {$j < 1000000} {incr j} {
+                    $rr SET x 5
+            }
+        } e
+        assert_match {I/O error reading reply} $e
+    }
 }
 
 start_server {tags {"auth_binary_password"}} {