CVE-2025-49844

EUVD-2025-33178

03.10.2025, 20:15

Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	9.9 CRITICAL	NETWORK	LOW	LOW	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 99.73%

Affected Products (NVD)

Vendor	Product	Version
redis	redis	𝑥 < 6.2.20
redis	redis	7.0 ≤ 𝑥 < 7.2.11
redis	redis	7.4.0 ≤ 𝑥 < 7.4.6
redis	redis	8.0.0 ≤ 𝑥 < 8.0.4
redis	redis	8.2.0 ≤ 𝑥 < 8.2.2
lfprojects	valkey	𝑥 < 7.2.11
lfprojects	valkey	8.0.0 ≤ 𝑥 < 8.0.6
lfprojects	valkey	8.1.0 ≤ 𝑥 < 8.1.4

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

redict

forky	7.3.6+ds-2 fixed
sid	7.3.6+ds-2 fixed

redis

bookworm	5:7.0.15-1~deb12u7 fixed
bookworm (security)	5:7.0.15-1~deb12u9 fixed
bullseye	vulnerable
bullseye (security)	5:6.0.16-1+deb11u9 fixed
forky	5:8.0.6-2 fixed
sid	5:8.0.6-2 fixed
trixie	5:8.0.2-3+deb13u2 fixed
trixie (security)	5:8.0.2-3+deb13u2 fixed

valkey

forky	8.1.4+dfsg1-2 fixed
sid	8.1.4+dfsg1-2 fixed
trixie	8.1.1+dfsg1-3+deb13u2 fixed
trixie (security)	8.1.1+dfsg1-3+deb13u2 fixed

Ubuntu Releases

Ubuntu Product

Codename

lua50

bionic	needed
focal	needed
jammy	dne
noble	dne
questing	dne
resolute	dne
xenial	needed

lua5.1

bionic	needed
focal	Fixed 5.1.5-8.1ubuntu0.20.04.1~esm1 released
jammy	Fixed 5.1.5-8.1ubuntu0.22.04.1~esm1 released
noble	needed
questing	ignored
resolute	needed
trusty	needed
xenial	Fixed 5.1.5-8ubuntu1+esm1 released

lua5.2

bionic	not-affected
focal	not-affected
jammy	not-affected
noble	not-affected
questing	not-affected
resolute	not-affected
trusty	not-affected
xenial	not-affected

lua5.3

bionic	not-affected
focal	not-affected
jammy	not-affected
noble	not-affected
questing	not-affected
resolute	not-affected
xenial	not-affected

lua5.4

jammy	not-affected
noble	not-affected
questing	not-affected
resolute	not-affected

redict

jammy	dne
noble	dne
plucky	Fixed 7.3.2+ds-1ubuntu0.1 released
questing	Fixed 7.3.5+ds-1ubuntu0.1 released
resolute	not-affected

redis

bionic	Fixed 5:4.0.9-1ubuntu0.2+esm6 released
focal	not-affected
jammy	not-affected
noble	Fixed 5:7.0.15-1ubuntu0.24.04.2 released
plucky	Fixed 5:7.0.15-3ubuntu0.1 released
questing	Fixed 5:8.0.2-3ubuntu0.25.10.1 released
resolute	not-affected
trusty	Fixed 2:2.8.4-2ubuntu0.2+esm5 released
xenial	Fixed 2:3.0.6-1ubuntu0.4+esm4 released

valkey

jammy	dne
noble	Fixed 7.2.11+dfsg1-0ubuntu0.2 released
plucky	Fixed 8.0.6+dfsg1-0ubuntu0.2 released
questing	Fixed 8.1.4+dfsg1-0ubuntu0.2 released
resolute	not-affected

openSUSE / SLES Releases

openSUSE Product

Release

redis

suse enterprise sap 15 SP6	7.2.4-150600.3.18.1 fixed
suse enterprise server 15 SP5	6.2.6-150400.3.40.1 fixed
suse enterprise server 15 SP6	7.2.4-150600.3.18.1 fixed

redis7

suse enterprise sap 15 SP6	7.0.8-150600.8.19.1 fixed
suse enterprise server 15 SP5	7.0.8-150500.3.24.1 fixed
suse enterprise server 15 SP6	7.0.8-150600.8.19.1 fixed

valkey

suse enterprise sap 15 SP6	8.0.6-150600.13.17.1 fixed
suse enterprise sap 15 SP7	8.0.6-150700.3.11.1 fixed
suse enterprise server 15 SP6	8.0.6-150600.13.17.1 fixed
suse enterprise server 15 SP7	8.0.6-150700.3.11.1 fixed

valkey-compat-redis

suse enterprise sap 15 SP6	8.0.6-150600.13.17.1 fixed
suse enterprise sap 15 SP7	8.0.6-150700.3.11.1 fixed
suse enterprise server 15 SP6	8.0.6-150600.13.17.1 fixed
suse enterprise server 15 SP7	8.0.6-150700.3.11.1 fixed

valkey-devel

suse enterprise sap 15 SP6	8.0.6-150600.13.17.1 fixed
suse enterprise sap 15 SP7	8.0.6-150700.3.11.1 fixed
suse enterprise server 15 SP6	8.0.6-150600.13.17.1 fixed
suse enterprise server 15 SP7	8.0.6-150700.3.11.1 fixed

Red Hat Enterprise Linux Releases

Red Hat Product

Release

redis

RHEL 9

0:6.2.20-2.el9_7

fixed

redis-devel

RHEL 9

0:6.2.20-2.el9_7

fixed

redis-doc

RHEL 9

0:6.2.20-2.el9_7

fixed

valkey

RHEL 9

0:8.0.6-2.el9_7

fixed

valkey-devel

RHEL 9

0:8.0.6-2.el9_7

fixed

Amazon Linux Releases

Amazon Package

Release

redis6

Amazon Linux 2023

0:6.2.20-2.amzn2023.0.1

fixed

redis6-debuginfo

Amazon Linux 2023

0:6.2.20-2.amzn2023.0.1

fixed

redis6-debugsource

Amazon Linux 2023

0:6.2.20-2.amzn2023.0.1

fixed

redis6-devel

Amazon Linux 2023

0:6.2.20-2.amzn2023.0.1

fixed

redis6-doc

Amazon Linux 2023

0:6.2.20-2.amzn2023.0.1

fixed

valkey

Amazon Linux 2023

0:8.0.6-3.amzn2023.0.2

fixed

valkey-debuginfo

Amazon Linux 2023

0:8.0.6-3.amzn2023.0.2

fixed

valkey-debugsource

Amazon Linux 2023

0:8.0.6-3.amzn2023.0.2

fixed

valkey-devel

Amazon Linux 2023

0:8.0.6-3.amzn2023.0.2

fixed

Azure Linux Releases

Azure Package

Release

redis

CBL-Mariner 2.0

0:6.2.20-1.cm2

fixed

valkey

Azure Linux 3.0

0:8.0.6-1.azl3

fixed

Common Weakness Enumeration

CWE-416 - Use After Free
Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.

References

https://github.com/redis/redis/commit/d5728cb5795c966c5b5b1e0f0ac576a7e69af539

https://github.com/redis/redis/releases/tag/8.2.2

https://github.com/redis/redis/security/advisories/GHSA-4789-qfc9-5f9q

http://www.openwall.com/lists/oss-security/2025/10/07/2

https://github.com/lastvocher/redis-CVE-2025-49844