PT-2025-40594 · Redis+10 · Redis+10
Benny Isaacs
+4
·
Published
2025-01-24
·
Updated
2026-04-19
·
CVE-2025-49844
CVSS v3.1
9.9
Critical
| Vector | AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Redis versions 5.7.0 through 5.8.0
Redict versions 7.3.2+ds-1ubuntu0.1
Valkey versions prior to 8.1.1+dfsg1-3+deb13u1
Description
Redis and Redict are vulnerable to a Lua scripting interface issue that could allow an authenticated attacker to trigger a use-after-free condition, potentially leading to remote code execution. Valkey is vulnerable to multiple security issues in its Lua scripting interface that could result in arbitrary code execution or denial of service.
Recommendations
Upgrade Redis to version 5.7.0.15-1~deb12u6 for bookworm or 5.8.0.2-3+deb13u1 for trixie.
Upgrade Redict to version 7.3.2+ds-1ubuntu0.1.
Upgrade Valkey to version 8.1.1+dfsg1-3+deb13u1.
Exploit
Fix
RCE
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Centos
Debian
Linuxmint
Red Hat
Red Os
Redis
Rocky Linux
Suse
Ubuntu