← Back

CVE-2025-49844

nvd nistnuclei
Published: Oct 3, 2025Modified: Jun 17, 2026

JSON object

Loading...
9.9
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Exploitability: 3.1 / Impact: 6.0
Source: NVD

Description

Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.

Affected (8)

Products: Redis: Redis · Lfprojects: Valkey
Redis
1 product
Redis
Lfprojects
1 product
Valkey
Configuration A
5 vulnerable
Vulnerable SoftwareAffected Versions
Redis
Redis
Before 6.2.20
Redis
From 7.0 to 7.2.11
Redis
From 7.4.0 to 7.4.6
Redis
From 8.0.0 to 8.0.4
Redis
From 8.2.0 to 8.2.2
Configuration B
3 vulnerable
Vulnerable SoftwareAffected Versions
Lfprojects
Valkey
Before 7.2.11
Valkey
From 8.0.0 to 8.0.6
Valkey
From 8.1.0 to 8.1.4

Related CWEs

CWE-416
Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

References (5)

Source: security-advisories@github.com
Patch
Source: security-advisories@github.com
Release Notes
Source: security-advisories@github.com
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.