CVE-2025-49112: 
Redis vulnerability analysis and mitigation

CVE-2025-49112 is a security vulnerability discovered in Valkey through version 8.1.1. The vulnerability exists in the setDeferredReply function within networking.c, where an integer underflow condition can occur during the calculation of prev->size - prev->used. The vulnerability was disclosed on June 2, 2025 (NVD).

The vulnerability is classified as an Integer Underflow (CWE-191) with a CVSS v3.1 Base Score of 3.1 (LOW). The vulnerability vector is CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L, indicating that it requires adjacent network access, has high attack complexity, requires no privileges, needs no user interaction, has unchanged scope, and can only impact availability at a low level (NVD).

The vulnerability affects the availability of the system at a low level. The integer underflow in the setDeferredReply function could potentially lead to memory corruption or system instability (Debian Tracker).

A fix has been implemented in version 8.1.1+dfsg1-2 of the Valkey package. The fix involves explicitly checking that prev->used is less than prev->size before performing the subtraction, avoiding reliance on unsigned arithmetic and ensuring the logic is clear and robust (GitHub PR).