Critical Flaw Exposes 60,000 Redis Servers to Remote Exploitation
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-49844 | Use-After-Free (RediShell) RCE in Redis Lua Scripting CVE-2025-49844, dubbed "RediShell," is a use-after-free (CWE-416) in Redis's embedded Lua scripting engine that per vendor and press coverage has existed for roughly 13 years in all Redis versions with Lua scripting enabled. An authenticated user triggers it by submitting a specially crafted Lua script (via EVAL/EVALSHA) that manipulates the garbage collector and causes a use-after-free condition. Successful exploitation can lead to remote code execution in the context of the redis-server process; the CVSS 3.1 score of 9.9 (critical) reflects network reachability, low required privileges, and changed scope. Redis versions up to and including 8.2.1 are affected, with 8.2.2 containing the fix, and the CPE data also lists the Valkey fork as affected. No confirmed in-the-wild exploitation is reported (not in CISA KEV), but a public proof-of-concept exists and EPSS assigns an 82.3% probability of exploitation within 30 days (100th percentile). Do: Upgrade redis-server to version 8.2.2 or later; for Valkey, apply the vendor's corresponding Lua fix when available. If patching is not immediately possible, restrict the EVAL and EVALSHA commands using Redis ACLs so users cannot execute Lua scripts, and verify that any internet-exposed instances require authentication. Review logs for unexpected or anomalous EVAL/EVALSHA usage from authenticated clients. | 9.9 | 82% | PoC |
| large≈60,000+ internet-exposed Redis servers; total Redis/Valkey deployments including private and cloud-hosted instances are likely in the millions |
Full article331 words · extracted from infosecurity-magazine.com · click to collapse
A critical security flaw in Redis, a popular in-memory database platform used by about 75% of cloud environments, has left an estimated 60,000 servers vulnerable to remote exploitation.
The flaw, identified as CVE-2025-49844 and nicknamed “RediShell,” carries the maximum severity score of 10.0 under the Common Vulnerability Scoring System (CVSS).
The issue, which has remained undetected for 13 years, lies in Redis’s embedded Lua scripting engine.
This use-after-free vulnerability allows authenticated attackers to upload specially crafted Lua scripts, escape the sandbox and execute arbitrary code on the host.
Once compromised, an attacker could deploy a reverse shell for persistent access, steal credentials, move laterally through internal networks or install malware and cryptominers.
Thousands of Servers Exposed Online
Although exploitation requires authentication, research by cloud security firm Wiz found approximately 330,000 Redis instances exposed to the internet, with about 60,000 not protected by any authentication. This combination of public exposure and weak configuration makes these servers especially vulnerable.
Redis and Wiz jointly disclosed the flaw on October 3, urging administrators to patch immediately.
The company released fixes for Redis versions 7.22.2-12, 7.8.6-207, 7.4.6-272, 7.2.4-138 and 6.4.2-131, along with corresponding updates for its open source and commercial editions.
Read more on cloud infrastructure security: Scanning of Palo Alto Portals Surges 500%
Redis advised users to apply updates without delay and implement additional safeguards:
-
Enable authentication and restrict access to trusted networks
-
Disable Lua scripting if not required
-
Run Redis as a non-root user
-
Enforce firewalls and Virtual Private Clouds (VPCs)
-
Monitor logs and set alerts for suspicious behavior
Broader Threat Landscape
Redis servers have long been a target for cybercriminals. Past attacks, such as those involving the P2PInfect, Redigo, HeadCrab and Migo malware, used unpatched or exposed instances to deploy cryptocurrency miners and ransomware.
While there is currently no evidence that CVE-2025-49844 has been exploited in the wild, experts warn that the widespread use of Redis and default insecure configurations make rapid patching and strict network controls essential to prevent future attacks.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/redis-servers-remote-exploitation/