CVE-2025-49844
📋 TL;DR
This CVE describes a critical vulnerability in Redis where authenticated users can execute specially crafted Lua scripts to manipulate the garbage collector, triggering a use-after-free condition that could lead to remote code execution. All Redis versions with Lua scripting enabled are affected, specifically versions 8.2.1 and below. Organizations running vulnerable Redis instances with authenticated user access are at risk.
💻 Affected Systems
- Redis
📦 What is this software?
Redis by Redis
Redis by Redis
Redis by Redis
Redis by Redis
Redis by Redis
Valkey by Lfprojects
Valkey by Lfprojects
Valkey by Lfprojects
⚠️ Risk & Real-World Impact
Worst Case
Full remote code execution with the privileges of the Redis process, potentially leading to complete system compromise, data theft, or lateral movement within the network.
Likely Case
Remote code execution leading to unauthorized access, data manipulation, or denial of service on the Redis server.
If Mitigated
Limited to denial of service if Lua scripting is disabled or access controls prevent exploitation.
🎯 Exploit Status
Exploitation requires authenticated access and crafting of specific Lua scripts. No public proof-of-concept has been released at this time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.2.2
Vendor Advisory: https://github.com/redis/redis/security/advisories/GHSA-4789-qfc9-5f9q
Restart Required: Yes
Instructions:
1. Download Redis 8.2.2 from the official repository. 2. Stop the Redis service. 3. Install the new version following Redis installation procedures. 4. Restart the Redis service.
🔧 Temporary Workarounds
Disable Lua Script Execution via ACL
allPrevents users from executing EVAL and EVALSHA commands using Redis Access Control Lists.
ACL SETUSER <username> -@all +@read +@write -eval -evalsha
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Redis instances from untrusted networks.
- Enforce strong authentication and limit user permissions to only necessary commands.
🔍 How to Verify
Check if Vulnerable:
Check Redis version with 'redis-server --version' or 'redis-cli INFO server | grep redis_version'. If version is 8.2.1 or lower, the system is vulnerable.Check Version:
redis-server --versionVerify Fix Applied:
After patching, verify the version is 8.2.2 or higher using the same commands.📡 Detection & Monitoring
Log Indicators:
- Unusual EVAL or EVALSHA command patterns
- Redis process crashes or abnormal termination
Network Indicators:
- Suspicious Lua script payloads in Redis protocol traffic
SIEM Query:
source="redis" AND (command="EVAL" OR command="EVALSHA") AND user!="default"