CVE-2025-29923 affects go-redis, a popular Go client library for Redis, where a timeout during the CLIENT SETINFO command at connection establishment can cause responses to be returned out of order. This race condition can result in a client receiving incorrect data, potentially leading to data corruption or unintended application behaviour. Applications using go-redis in Azure or other cloud environments that rely on connection pooling may be silently affected.

Architect’s Take: Audit any workloads using the go-redis library and upgrade to the patched version as soon as possible. Pay particular attention to services with high connection churn or aggressive connection timeouts, as these are most likely to trigger the out-of-order response condition.

Original advisory: CVE-2025-29923 go-redis allows potential out of order responses when CLIENT SETINFO times out during connection establishment

CVE-2024-7598 is a race condition vulnerability in Kubernetes namespace termination that can allow an attacker to bypass network restrictions within Azure-hosted clusters. During the brief window when a namespace is being deleted, network policies may not be correctly enforced, potentially permitting unauthorised traffic between pods or services. This matters because it could allow lateral movement or data exfiltration in multi-tenant or segmented environments.

Architect’s Take: Review any workloads relying solely on Kubernetes network policies for isolation in Azure Kubernetes Service (AKS); consider supplementing with Azure Network Security Groups or Calico-enforced policies and monitor for unexpected cross-namespace traffic, particularly during namespace lifecycle events. Apply any available patches or mitigations from Microsoft promptly.

Original advisory: CVE-2024-7598 Network restriction bypass via race condition during namespace termination