Redis · Redis · CVE-2025-49844
**Name of the Vulnerable Software and Affected Versions**
Redis versions prior to 8.2.2
Redis versions prior to 8.0.4
Redis versions prior to 7.4.6
Redis versions prior to 7.2.11
Redis versions prior to 6.2.20
**Description**
A use-after-free memory corruption issue exists in the Lua scripting engine of Redis. An authenticated user can exploit this by sending a specially crafted Lua script to manipulate the Lua garbage collector (GC), allowing them to escape the Lua sandbox and execute arbitrary code on the host system. This can lead to full system compromise, including the theft of credentials, data exfiltration, or the installation of malware. Approximately 330,000 Redis instances are exposed to the internet, with at least 60,000 lacking authentication, which effectively allows unauthenticated remote code execution in those cases.
**Recommendations**
Update Redis to version 8.2.2, 8.0.4, 7.4.6, 7.2.11, or 6.2.20.
As a temporary workaround, restrict the use of `EVAL` and `EVALSHA` commands via Access Control Lists (ACLs) to prevent the execution of Lua scripts.
Enforce strong authentication using `requirepass`.
Restrict network access to Redis instances using firewalls or VPCs to ensure they are only accessible from trusted hosts.
Run Redis using a non-root user account.