CVE-2025-49844

Name of the Vulnerable Software and Affected Versions Redis versions prior to 8.2.2 Redis versions prior to 8.0.4 Redis versions prior to 7.4.6 Redis versions prior to 7.2.11 Redis versions prior to 6.2.20

Description A use-after-free memory corruption issue exists in the Lua scripting engine of Redis. An authenticated user can exploit this by sending a specially crafted Lua script to manipulate the Lua garbage collector (GC), allowing them to escape the Lua sandbox and execute arbitrary code on the host system. This can lead to full host takeover, enabling attackers to steal credentials, exfiltrate data, or install malware. Approximately 330,000 Redis instances are exposed to the internet, with at least 60,000 lacking authentication, which effectively allows unauthenticated remote code execution in those cases.

Recommendations Update Redis to version 8.2.2, 8.0.4, 7.4.6, 7.2.11, or 6.2.20. As a temporary workaround, restrict the use of EVAL and EVALSHA commands via Access Control Lists (ACLs) to prevent the execution of Lua scripts. Enforce strong authentication using requirepass. Restrict network access to Redis instances using firewalls or VPCs to ensure they are only accessible from trusted hosts. Run Redis using a non-root user account.