13-Year-Old Redis Flaw Exposed: CVSS 10.0 Vulnerability Lets Attackers Run Code Remotely
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-49844 | Use-After-Free (RediShell) RCE in Redis Lua Scripting CVE-2025-49844, dubbed "RediShell," is a use-after-free (CWE-416) in Redis's embedded Lua scripting engine that per vendor and press coverage has existed for roughly 13 years in all Redis versions with Lua scripting enabled. An authenticated user triggers it by submitting a specially crafted Lua script (via EVAL/EVALSHA) that manipulates the garbage collector and causes a use-after-free condition. Successful exploitation can lead to remote code execution in the context of the redis-server process; the CVSS 3.1 score of 9.9 (critical) reflects network reachability, low required privileges, and changed scope. Redis versions up to and including 8.2.1 are affected, with 8.2.2 containing the fix, and the CPE data also lists the Valkey fork as affected. No confirmed in-the-wild exploitation is reported (not in CISA KEV), but a public proof-of-concept exists and EPSS assigns an 82.3% probability of exploitation within 30 days (100th percentile). Do: Upgrade redis-server to version 8.2.2 or later; for Valkey, apply the vendor's corresponding Lua fix when available. If patching is not immediately possible, restrict the EVAL and EVALSHA commands using Redis ACLs so users cannot execute Lua scripts, and verify that any internet-exposed instances require authentication. Review logs for unexpected or anomalous EVAL/EVALSHA usage from authenticated clients. | 9.9 | 82% | PoC |
| large≈60,000+ internet-exposed Redis servers; total Redis/Valkey deployments including private and cloud-hosted instances are likely in the millions |
Full article485 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananOct 07, 2025Vulnerability / Cloud Security
Redis has disclosed details of a maximum-severity security flaw in its in-memory database software that could result in remote code execution under certain circumstances.
The vulnerability, tracked as CVE-2025-49844 (aka RediShell), has been assigned a CVSS score of 10.0.
"An authenticated user may use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free, and potentially lead to remote code execution," according to a GitHub advisory for the issue. "The problem exists in all versions of Redis with Lua scripting."
However, for exploitation to be successful, it requires an attacker to first gain authenticated access to a Redis instance, making it crucial that users don't leave their Redis instances exposed to the internet and secure them with strong authentication.
The issue impacts all versions of Redis. It has been addressed in versions 6.2.20, 7.2.11, 7.4.6, 8.0.4, and 8.2.2 released on October 3, 2025.
As temporary workarounds until a patch can be applied, it's advised to prevent users from executing Lua scripts by setting an access control list (ACL) to restrict EVAL and EVALSHA commands. It's also crucial that only trusted identities can run Lua scripts or any other potentially risky commands.
Cloud security company Wiz, which discovered and reported the flaw to Redis on May 16, 2025, described it as a use-after-free (UAF) memory corruption bug that has existed in the Redis source code for about 13 years.
It essentially permits an attacker to send a malicious Lua script that leads to arbitrary code execution outside of the Redis Lua interpreter sandbox, granting them unauthorized access to the underlying host. In a hypothetical attack scenario, it can be leveraged to steal credentials, drop malware, exfiltrate sensitive data, or pivot to other cloud services.
"This flaw allows a post auth attacker to send a specially crafted malicious Lua script (a feature supported by default in Redis) to escape from the Lua sandbox and achieve arbitrary native code execution on the Redis host," Wiz said. "This grants an attacker full access to the host system, enabling them to exfiltrate, wipe, or encrypt sensitive data, hijack resources, and facilitate lateral movement within cloud environments."
While there is no evidence that the vulnerability was ever exploited in the wild, Redis instances are a lucrative target for threat actors looking to conduct cryptojacking attacks and enlist them in a botnet. As of writing, there are about 330,000 Redis instances exposed to the internet, out of which about 60,000 of them lack any authentication.
"With hundreds of thousands of exposed instances worldwide, this vulnerability poses a significant threat to organizations across all industries," Wiz said. "The combination of widespread deployment, default insecure configurations, and the severity of the vulnerability creates an urgent need for immediate remediation."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/10/13-year-redis-flaw-exposed-cvss-100.html