PT-2025-40594 · Redis +9 · Redis +9

Benny Isaacs + 4 · Published 2025-10-03 · Updated 2025-11-13 · CVE-2025-49844

Positive Technologies · (AI Summary)

CVSS v3.1

9.9

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Redis versions prior to 8.2.2 Redis versions prior to 8.0.4 Redis versions prior to 7.4.6 Redis versions prior to 7.2.11 Redis versions prior to 6.2.20

Description Redis contains a Lua scripting vulnerability that can lead to remote code execution (RCE). This flaw, dubbed RediShell (CVE-2025-49844), is a use-after-free memory corruption issue present in the Lua scripting engine. An authenticated attacker can exploit this by sending a specially crafted Lua script, escaping the Lua sandbox, and executing arbitrary code on the host system. Approximately 330,000 Redis instances are exposed to the internet, with around 60,000 lacking authentication, increasing the risk of exploitation. The vulnerability has existed for 13 years. Successful exploitation can allow attackers to steal credentials, deploy malware, or move laterally within a network. The

EVAL

and

EVALSHA

commands are involved in the exploitation process.

Recommendations Upgrade Redis to version 8.2.2 or later. Upgrade Redis to version 8.0.4 or later. Upgrade Redis to version 7.4.6 or later. Upgrade Redis to version 7.2.11 or later. Upgrade Redis to version 6.2.20 or later. Restrict the use of the

EVAL

and

EVALSHA

commands via Access Control Lists (ACLs) as a temporary mitigation. Ensure Redis instances are not directly exposed to the internet. Enforce strong authentication for all Redis instances. Run Redis with a non-privileged user account. Implement network restrictions to limit access to Redis instances.

Exploit

Fix

RCE

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALSA-2025:19237

ALSA-2025:19238

ALSA-2025:19345

ALSA-2025:19675

ALT-PU-2025-12931

ALT-PU-2025-13204

BDU:2025-12553

BIT-KEYDB-2025-49844

BIT-REDIS-2025-49844

BIT-VALKEY-2025-49844

CESA-2025_19238

CVE-2025-49844

DLA-4325-1

DSA-6020-1

DSA-6022-1

GHSA-4789-QFC9-5F9Q

INFSA-2025_19237

INFSA-2025_19238

INFSA-2025_19345

OESA-2025-2389

OESA-2025-2390

OESA-2025-2450

OESA-2025-2451

OESA-2025-2452

OESA-2025-2453

RHSA-2025_19237

RHSA-2025_19238

RHSA-2025_19345

RHSA-2025_20926

RHSA-2025_20955

SUSE-SU-2025:03499-1

SUSE-SU-2025:03500-1

SUSE-SU-2025:03501-1

SUSE-SU-2025:03502-1

SUSE-SU-2025:03505-1

SUSE-SU-2025:03506-1

SUSE-SU-2025:03507-1

USN-7824-1

USN-7824-2

USN-7824-3

ZDI-25-933

Affected Products

Alt Linux

Almalinux

Centos

Debian

Linuxmint

Red Hat

Red Os

Redis

Rocky Linux

Ubuntu

References · 336

• 🔥 https://github.com/raminfp/redis_exploit · Exploit
• 🔥 https://github.com/dwisiswant0/CVE-2025-49844 · Exploit
• 🔥 https://github.com/convisolabs/CVE-2022-24834 · Exploit
• https://github.com/redis/redis/commit/d5728cb5795c966c5b5b1e0f0ac576a7e69af539 · Patch
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25155 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-41056 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:03499-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-46817 · Security Note
• https://errata.rockylinux.org/RLSA-2025:19237 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-12557 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22458 · Security Note
• https://errata.almalinux.org/8/ALSA-2025-19238.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35977 · Security Note
• https://bdu.fstec.ru/vul/2022-05912 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:03507-1 · Vendor Advisory