CVE-2025-49844 | Redis is an open source, in-memory database that persists on… | CVSS 10.0 CRITICAL

Description

Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.

Metadata

CVE ID: CVE-2025-49844
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2025-06-11 14:33 UTC
Published: 2025-10-03 19:27 UTC
Last updated: 2026-03-20 14:08 UTC
Primary CWE: CWE-416
CWE-416: Use After Free
Vendor / Product: redis / redis
Sources: cve.org · NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: no
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
redis	redis	—	< 8.2.2

Weakness (CWE)

CWE	Source	Description
CWE-416	cna	CWE-416: Use After Free

CVSS scores (1)

Score	Severity	Version	Source	Vector
10.0	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References (3)

https://github.com/redis/redis/security/advisories/GHSA-4789-qfc9-5f9q https://github.com/redis/redis/security/advisories/GHSA-4789-qfc9-5f9q
https://github.com/redis/redis/commit/d5728cb5795c966c5b5b1e0f0ac576a7e69af539 https://github.com/redis/redis/commit/d5728cb5795c966c5b5b1e0f0ac576a7e69af539
https://github.com/redis/redis/releases/tag/8.2.2 https://github.com/redis/redis/releases/tag/8.2.2