Vulnerability Report: GO-2025-3540

Affected Packages

• Path
  Go Versions
  Custom Versions^*
  Symbols
• github.com/redis/go-redis/v9
  all versions, no known fixed
  -
  5 unexported affected symbols

  • baseClient.initConn
  • redis.ClusterOptions
  • redis.FailoverOptions
  • redis.RingOptions
  • redis.UniversalOptions
• github.com/redis/go-redis/v9
  from v9.5.1 before v9.5.5
  -
  5 unexported affected symbols

  • baseClient.initConn
  • redis.ClusterOptions
  • redis.FailoverOptions
  • redis.RingOptions
  • redis.UniversalOptions
• github.com/redis/go-redis/v9
  before v9.6.3
  -
  5 unexported affected symbols

  • baseClient.initConn
  • redis.ClusterOptions
  • redis.FailoverOptions
  • redis.RingOptions
  • redis.UniversalOptions
• github.com/redis/go-redis/v9
  from v9.7.0-beta.1 before v9.7.3
  -
  5 unexported affected symbols

  • baseClient.initConn
  • redis.ClusterOptions
  • redis.FailoverOptions
  • redis.RingOptions
  • redis.UniversalOptions

Affected Modules

• Path
  Go Versions
  Custom Versions^*
• github.com/redis/go-redis
  all versions, no known fixed
  -
• github.com/redis/go-redis
  all versions, no known fixed
  -
• github.com/redis/go-redis/v7
  all versions, no known fixed
  -
• github.com/redis/go-redis/v8
  all versions, no known fixed
  -

^{*Custom versions, which can't be mapped automatically to standard Go module versions, are ignored by govulncheck. (See this note on versions for more details.)}

Aliases

• CVE-2025-29923
• GHSA-92cp-5422-2mw7

References

• https://github.com/redis/go-redis/security/advisories/GHSA-92cp-5422-2mw7
• https://github.com/redis/go-redis/commit/d236865b0cfa1b752ea4b7da666b1fdcd0acebb6
• https://github.com/redis/go-redis/pull/3295
• https://vuln.go.dev/ID/GO-2025-3540.json

Feedback