Redis patches 13-Year-Old Lua flaw enabling Remote Code Execution
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-49844 | Use-After-Free (RediShell) RCE in Redis Lua Scripting CVE-2025-49844, dubbed "RediShell," is a use-after-free (CWE-416) in Redis's embedded Lua scripting engine that per vendor and press coverage has existed for roughly 13 years in all Redis versions with Lua scripting enabled. An authenticated user triggers it by submitting a specially crafted Lua script (via EVAL/EVALSHA) that manipulates the garbage collector and causes a use-after-free condition. Successful exploitation can lead to remote code execution in the context of the redis-server process; the CVSS 3.1 score of 9.9 (critical) reflects network reachability, low required privileges, and changed scope. Redis versions up to and including 8.2.1 are affected, with 8.2.2 containing the fix, and the CPE data also lists the Valkey fork as affected. No confirmed in-the-wild exploitation is reported (not in CISA KEV), but a public proof-of-concept exists and EPSS assigns an 82.3% probability of exploitation within 30 days (100th percentile). Do: Upgrade redis-server to version 8.2.2 or later; for Valkey, apply the vendor's corresponding Lua fix when available. If patching is not immediately possible, restrict the EVAL and EVALSHA commands using Redis ACLs so users cannot execute Lua scripts, and verify that any internet-exposed instances require authentication. Review logs for unexpected or anomalous EVAL/EVALSHA usage from authenticated clients. | 9.9 | 82% | PoC |
| large≈60,000+ internet-exposed Redis servers; total Redis/Valkey deployments including private and cloud-hosted instances are likely in the millions |
Full article539 words · extracted from securityaffairs.com · click to collapse
Redis warns of CVE-2025-49844, a Lua script flaw enabling RCE via use-after-free. Attackers need authenticated access to exploit it.
Redis disclosed a critical RCE bug, tracked as CVE-2025-49844 (also known as “RediShell”, with a CVSS score of 10.0), where a malicious Lua script can exploit the garbage collector to trigger a use-after-free vulnerability and enable remote code execution.
Cybersecurity firm Wiz discovered the bug and reported it to Redis on May 16, 2025. It’s a 13-year-old use-after-free flaw that lets a malicious Lua script break out of the sandbox and execute arbitrary code on the host.
“The vulnerability exploits a Use-After-Free (UAF) memory corruption bug that has existed for approximately 13 years in the Redis source code. This flaw allows a post auth attacker to send a specially crafted malicious Lua script (a feature supported by default in Redis) to escape from the Lua sandbox and achieve arbitrary native code execution on the Redis host.” reads the report published by Wiz. “This grants an attacker full access to the host system, enabling them to exfiltrate, wipe, or encrypt sensitive data, hijack resources, and facilitate lateral movement within cloud environments.”
Below is the Disclosure Timeline:
- Oct 6, 2025: Wiz Research publishes this blog post.
- May 16, 2025: Initial vulnerability report sent to Redis in Pwn2Own Berlin.
- Oct 3, 2025: Redis publishes the security bulletin and assigned CVE-2025-49844.
The researchers warn of real attacks, which could enable credential theft, malware deployment, data exfiltration, or lateral movement to other cloud services.
Exploitation requires prior authenticated access, so secure Redis instances (no Internet exposure, strong auth).
“[CVE-2025-49844] Lua use-after-free may lead to remote code execution. CVSS Score: 10.0 (Critical)” reads the advisory. “An authenticated user may use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code execution.”
The vulnerability impacts all versions of Redis with Lua scripting.
“The problem exists in all versions of Redis with Lua scripting.” reads a GitHub advisory.
The company addressed the issue with the release of versions 6.2.20, 7.2.11, 7.4.6, 8.0.4, and 8.2.2 released on October 3, 2025. As a workaround, restrict EVAL and EVALSHA via ACLs and allow only trusted users to run Lua scripts or other risky commands.
Given that Redis is used in an estimated 75% of cloud environments, the potential impact is extensive. Organizations are strongly addressing their instances immediately by prioritizing those that are exposed to the internet.
The attack chain for RediShell (CVE-2025-49844) shows an attacker sending a malicious Lua script to trigger a use-after-free, escape the Lua sandbox and execute arbitrary code. They open a reverse shell for persistence, steal credentials (.ssh, IAM tokens, certs), install malware or miners, exfiltrate data from Redis and the host, then use stolen tokens to access cloud services, escalate privileges, and move laterally to further compromise systems.
“RediShell (CVE-2025-49844) represents a critical security vulnerability that affects all Redis versions due to its root cause in the underlying Lua interpreter. With hundreds of thousands of exposed instances worldwide, this vulnerability poses a significant threat to organizations across all industries.” concludes Wiz.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CVE-2025-49844)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/183097/security/redis-patches-13-year-old-lua-flaw-enabling-remote-code-execution.html