Redis patches critical "RediShell" RCE vulnerability, update ASAP! (CVE-2025-49844)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-49844 | Use-After-Free (RediShell) RCE in Redis Lua Scripting CVE-2025-49844, dubbed "RediShell," is a use-after-free (CWE-416) in Redis's embedded Lua scripting engine that per vendor and press coverage has existed for roughly 13 years in all Redis versions with Lua scripting enabled. An authenticated user triggers it by submitting a specially crafted Lua script (via EVAL/EVALSHA) that manipulates the garbage collector and causes a use-after-free condition. Successful exploitation can lead to remote code execution in the context of the redis-server process; the CVSS 3.1 score of 9.9 (critical) reflects network reachability, low required privileges, and changed scope. Redis versions up to and including 8.2.1 are affected, with 8.2.2 containing the fix, and the CPE data also lists the Valkey fork as affected. No confirmed in-the-wild exploitation is reported (not in CISA KEV), but a public proof-of-concept exists and EPSS assigns an 82.3% probability of exploitation within 30 days (100th percentile). Do: Upgrade redis-server to version 8.2.2 or later; for Valkey, apply the vendor's corresponding Lua fix when available. If patching is not immediately possible, restrict the EVAL and EVALSHA commands using Redis ACLs so users cannot execute Lua scripts, and verify that any internet-exposed instances require authentication. Review logs for unexpected or anomalous EVAL/EVALSHA usage from authenticated clients. | 9.9 | 82% | PoC |
| large≈60,000+ internet-exposed Redis servers; total Redis/Valkey deployments including private and cloud-hosted instances are likely in the millions |
Full article509 words · extracted from helpnetsecurity.com · click to collapse
Redis, the company behind the widely used in-memory data structure store of the same name, has released patches for a critical vulnerability (CVE-2025-49844) that may allow attackers full access to the underlying host system.
“This flaw allows a post auth attacker to send a specially crafted malicious Lua script (a feature supported by default in Redis) to escape from the Lua sandbox and achieve arbitrary native code execution on the Redis host,” Wiz researchers noted.
To make matters even worse, the official Redis container images have authentication disabled by default.
“Our analysis shows that 57% of cloud environments install Redis as an image. If not installed carefully, these instances may lack authentication entirely. The combination of no authentication and exposure to the internet is highly dangerous, allowing anyone to query the Redis instance and, specifically, send Lua scripts (…). This enables attackers to exploit the vulnerability and achieve RCE within the environment,” the researchers added.
About CVE-2025-49844
Dubbed RediShell by the Wiz researchers who found and reported it, CVE-2025-49844 stems from a use-after-free memory corruption bug that may allow attackers to manipulate Redis’ Garbage Collector via specially crafted Lua scripts.
Once a vulnerable Redis installation is breached and the underlying host is compromised, attackers may establish persistent access, install cryptominers or malware, exfiltrate sensitive data both from Redis and the host, compromise / steal credentials and use some of them (e.g., IAM tokens) to access other cloud services, Wiz researchers noted.
The vulnerable code was added to Redis’ codebase in 2012. Thus, CVE-2025-49844 affects Redis (server) versions that use Lua scripting: v8.2.1 and earlier.
The vulnerability has been fixed in:
- (Commercial, closed-source) Redis Software releases – 7.22.2-12 and higher, 7.8.6-207 and higher, 7.4.6-272 and higher, 7.2.4-138 and higher, 6.4.2-131 and higher
- Redis OSS/CE (open-source/Community Edition) releases with Lua scripting: 8.2.2 and higher, 8.0.4 and higher, 7.4.6 and higher, 7.2.11 and higher
- Redis Stack releases: 7.4.0-v7 and higher, 7.2.0-v19 and higher
Update or disable Lua scripting
Wiz researchers say that there are approximately 330,000 internet-exposed Redis instances out there, and about 60,000 of them have no authentication configured.
The German Federal Office for Information Security (BSI) has also released an alert about the flaw, noting that in Germany alone there are about 4,000 Redis servers esposed without authentication.
BSI pointed out that given the simplicity of the attack and the wide use of Redis, exploitation attempts are expected soon, especially once technical details become public.
Wiz has refrained from sharing technical details for now.
IT administrators have been advised to install updates immediately or, alternatively, to disable Lua scripting by using Access Control Lists (ACLs) to restrict the EVAL and EVALSHA commands.
Wiz researchers also advised hardening Redis installations by:
- Enabling authentication
- Disabling unnecessary commands
- Operating Redis with a non-root user account
- Activating Redis logging and monitoring to track activity and identify potential issues
- Implementing network-level access control, and
- Limiting access to Redis only from authorized networks.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2025/10/07/redis-patches-critical-redishell-rce-vulnerability-update-asap-cve-2025-49844/