CVE-2025-49844 Details
Description
Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.
A critical remote code execution vulnerability has been identified in Redis versions 8.2.1 and prior. This issue allows an authenticated user to execute a specially crafted Lua script that manipulates the garbage collector, triggering a use-after-free condition. The vulnerability exists in all Redis versions that support Lua scripting.
Users can upgrade to Redis version 8.2.2, which addresses this vulnerability. Alternatively, without patching the Redis server executable, Lua script execution can be disabled by using Access Control Lists (ACLs) to restrict the EVAL and EVALSHA commands.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/lastvocher/redis-CVE-2025-49844 | CISA-ADP | |
| http://www.openwall.com/lists/oss-security/2025/10/07/2 | CVE | Mailing ListThird Party Advisory |
| https://github.com/redis/redis/commit/d5728cb5795c966c5b5b1e0f0ac576a7e69af539 | [email protected] | Patch |
| https://github.com/redis/redis/releases/tag/8.2.2 | [email protected] | Release Notes |
| https://github.com/redis/redis/security/advisories/GHSA-4789-qfc9-5f9q | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-416 | Use After Free | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| redis redis | < 6.2.20 >= 7.0, < 7.2.11 >= 7.4.0, < 7.4.6 >= 8.0.0, < 8.0.4 >= 8.2.0, < 8.2.2 |
CPE
Remediation
| |
| lfprojects valkey | < 7.2.11 >= 8.0.0, < 8.0.6 >= 8.1.0, < 8.1.4 |
CPE
Remediation
| |
Change History
9 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 20, 2026 | CVE Modified | CISA-ADP |
| Nov 12, 2025 | Modified Analysis | [email protected] |
| Nov 4, 2025 | CVE Modified | CVE |
| Oct 16, 2025 | Reanalysis | [email protected] |
| Oct 7, 2025 | Reanalysis | [email protected] |
| Oct 6, 2025 | Initial Analysis | [email protected] |
| Oct 3, 2025 | New CVE Received | [email protected] |