x/vulndb: potential Go vuln in github.com/redis/go-redis/v9: GHSA-92cp-5422-2mw7

[GoVulnBot]

Advisory GHSA-92cp-5422-2mw7 references a vulnerability in the following Go modules:

Module
github.com/redis/go-redis
github.com/redis/go-redis/v7
github.com/redis/go-redis/v8
github.com/redis/go-redis/v9
github.com/redis/go-redis/v9
github.com/redis/go-redis/v9

Description:

Impact

The issue only occurs when the CLIENT SETINFO command times out during connection establishment. The following circumstances can cause such a timeout:

1. The client is configured to transmit its identity. This can be disabled via the DisableIndentity flag.
2. There are network connectivity issues
3. The client was configured with aggressive timeouts

The impact differs by use case:

• Sticky connections: Rather than using a connection from the pool on-demand, the caller can stick with a connection. Then you receive persistent out-of-order responses for the lifetime of the ...

References:

• ADVISORY: GHSA-92cp-5422-2mw7
• ADVISORY: GHSA-92cp-5422-2mw7
• ADVISORY: https://nvd.nist.gov/vuln/detail/CVE-2025-29923
• FIX: redis/go-redis@d236865
• FIX: fix: handle network error on SETINFO redis/go-redis#3295

No existing reports found with this module or alias.
See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/redis/go-redis
      non_go_versions:
        - introduced: 9.6.0b1
      vulnerable_at: 6.15.9+incompatible
    - module: github.com/redis/go-redis/v7
      vulnerable_at: 7.4.1
    - module: github.com/redis/go-redis/v8
      vulnerable_at: 8.11.5
    - module: github.com/redis/go-redis/v9
      versions:
        - introduced: 9.5.1
        - fixed: 9.5.5
      vulnerable_at: 9.5.4
    - module: github.com/redis/go-redis/v9
      versions:
        - fixed: 9.6.3
      vulnerable_at: 9.6.2
    - module: github.com/redis/go-redis/v9
      versions:
        - introduced: 9.7.0-beta.1
        - fixed: 9.7.3
      vulnerable_at: 9.7.2
summary: |-
    go-redis allows potential out of order responses when `CLIENT SETINFO` times out
    during connection establishment in github.com/redis/go-redis
cves:
    - CVE-2025-29923
ghsas:
    - GHSA-92cp-5422-2mw7
references:
    - advisory: https://github.com/advisories/GHSA-92cp-5422-2mw7
    - advisory: https://github.com/redis/go-redis/security/advisories/GHSA-92cp-5422-2mw7
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2025-29923
    - fix: https://github.com/redis/go-redis/commit/d236865b0cfa1b752ea4b7da666b1fdcd0acebb6
    - fix: https://github.com/redis/go-redis/pull/3295
notes:
    - fix: 'module merge error: could not merge versions of module github.com/redis/go-redis/v9: introduced and fixed versions must alternate'
source:
    id: GHSA-92cp-5422-2mw7
    created: 2025-03-20T19:01:52.597494245Z
review_status: UNREVIEWED

[gopherbot]

Change https://go.dev/cl/660655 mentions this issue: data/reports: add 3 reports