CVE-2025-49844

critical

Description

Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.

References

https://github.com/redis/redis/security/advisories/GHSA-4789-qfc9-5f9q

http://www.openwall.com/lists/oss-security/2025/10/07/2

https://securelist.com/container-security-typical-issues/119974/

https://www.cisa.gov/news-events/ics-advisories/icsa-26-083-03

https://docs.cloud.google.com/support/bulletins/index#gcp-2025-061

https://securityaffairs.com/183097/security/redis-patches-13-year-old-lua-flaw-enabling-remote-code-execution.html

https://www.securityweek.com/critical-vulnerability-puts-60000-redis-servers-at-risk-of-exploitation/

https://www.infosecurity-magazine.com/news/redis-servers-remote-exploitation/

https://www.helpnetsecurity.com/2025/10/07/redis-patches-critical-redishell-rce-vulnerability-update-asap-cve-2025-49844/

https://www.darkreading.com/cloud-security/patch-now-redishell-redis-rce

https://thehackernews.com/2025/10/13-year-redis-flaw-exposed-cvss-100.html

https://hackread.com/13-year-old-redishell-vulnerability-redis-servers-risk/

https://www.bleepingcomputer.com/news/security/redis-warns-of-max-severity-flaw-impacting-thousands-of-instances/

https://github.com/wjhcd145/redis-recon-pro

https://github.com/dajneem23/CVE-2025-49844

https://github.com/hzhsec/redis-cve_2025_49844

https://github.com/Network-Sec/CVE-2025-49844-RediShell-AI-made-Revshell

https://github.com/imbas007/CVE-2025-49844-Vulnerability-Scanner

https://github.com/Mufti22/CVE-2025-49844-RediShell-Vulnerability-Scanner

https://github.com/Yuri08loveElaina/CVE-2025-49844

https://github.com/srozb/reditrap

https://github.com/dwisiswant0/CVE-2025-49844

https://github.com/redis/redis/releases/tag/8.2.2

https://github.com/redis/redis/commit/d5728cb5795c966c5b5b1e0f0ac576a7e69af539

https://github.com/lastvocher/redis-CVE-2025-49844

Details

Source: Mitre, NVD

Published: 2025-10-03

Updated: 2026-03-20

Named Vulnerability: RediShell

Risk Information

CVSS v2

Base Score: 9

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

Severity: High

CVSS v3

Base Score: 9.9

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Severity: Critical

EPSS

EPSS: 0.82294

Vulnerability Watch

Tenable Research has classified this CVE under the following Vulnerability Watch classification, which includes active and historical (inactive) classifications. You can learn more about these classifications on our blog.

Vulnerability Being Monitored

Detections

Analytics