CVE-2025-49844: Redis remote code execution (CVSS 9.9)

Description

Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredLow

User interactionNone

ScopeChanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected products

Lfprojects Valkey≥ 8.0.0 < 8.0.6 · ≥ 8.1.0 < 8.1.4 · < 7.2.11

Redis≥ 7.0 < 7.2.11 · ≥ 7.4.0 < 7.4.6 · ≥ 8.0.0 < 8.0.4 · ≥ 8.2.0 < 8.2.2

Remediation

Fixed in

Lfprojects Valkey≥ 8.0.6

Redis≥ 7.2.11

Patch & vendor advisories

https://github.com/redis/redis/commit/d5728cb5795c966c5b5b1e0f0ac576a7e69af539

References

https://github.com/lastvocher/redis-CVE-2025-49844
https://github.com/redis/redis/commit/d5728cb5795c966c5b5b1e0f0ac576a7e69af539Patch
https://github.com/redis/redis/releases/tag/8.2.2Release Notes
https://github.com/redis/redis/security/advisories/GHSA-4789-qfc9-5f9qThird Party Advisory
http://www.openwall.com/lists/oss-security/2025/10/07/2Mailing ListThird Party Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2025-49844 being actively exploited?

CVE-2025-49844 is not in the CISA KEV catalog. Its EPSS exploit probability is 82.3%.

How severe is CVE-2025-49844?

CVE-2025-49844 has a CVSS 3.1 base score of 9.9, rated critical. EPSS estimates a 82.3% probability of exploitation.

Which products are affected by CVE-2025-49844?

Affected products include Lfprojects Valkey, Redis.

How do I fix CVE-2025-49844?

Upgrade affected software to a fixed version, for example Lfprojects Valkey 8.0.6, Redis 7.2.11 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2025-49844 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo