Skip to content
Fencer Vulns
critical 10.0

CVE-2025-49844 in the critical feed json

Redis Lua Use-After-Free may lead to remote code execution

published 2025-10-03 13 mo ago modified 2026-10-19 20 d ago also BIT-keydb-2025-49844 , BIT-redis-2025-49844 , BIT-valkey-2025-49844 , EUVD-2025-33178 , GHSA-4789-qfc9-5f9q

cvss
10.0
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
82.6%
EPSS 82.6% chance of exploitation in 30 days, percentile 99.6%
public exploits
0
none known, plus a Nuclei check

Summary

Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.

Patch / fix

  • bitnami keydb 6.2.20, 7.2.11, 7.4.6, 8.0.4, 8.2.2
  • bitnami redis 6.2.20, 7.2.11, 7.4.6, 8.0.4, 8.2.2
  • bitnami valkey 7.2.11, 8.0.6, 8.1.4
  • redis redis 6.2.20, 7.2.11, 7.4.6, 8.0.4, 8.2.2
  • redislabs redis 6.2.20, 7.2.11, 7.4.6, 8.0.4, 8.2.2
  • lfprojects valkey 7.2.11, 8.0.6, 8.1.4
  • linuxfoundation valkey 7.2.11, 8.0.6, 8.1.4
  • valkey-io valkey 7.2.11, 8.0.6, 8.1.4
  • redict redict 7.3.6
  • redis Debian 12 5:7.0.15-1~deb12u6
  • redis Debian 13 5:8.0.2-3+deb13u1
  • redis Debian 14 5:8.0.4-1
  • redict Debian 14 7.3.6+ds-1
  • valkey Debian 13 8.1.1+dfsg1-3+deb13u1
  • valkey Debian 14 8.1.4+dfsg1-1

debian advisories DEBIAN-CVE-2025-49844

  • redis Ubuntu 24.04 LTS 5:7.0.15-1ubuntu0.24.04.2
  • redis Ubuntu 25.10 5:8.0.2-3ubuntu0.25.10.1
  • redict Ubuntu 25.10 7.3.5+ds-1ubuntu0.1
  • valkey Ubuntu 24.04 LTS 7.2.11+dfsg1-0ubuntu0.2
  • valkey Ubuntu 25.10 8.1.4+dfsg1-0ubuntu0.2
  • redis Ubuntu Pro 14.04 LTS 2:2.8.4-2ubuntu0.2+esm5
  • redis Ubuntu Pro 16.04 LTS 2:3.0.6-1ubuntu0.4+esm4
  • redis Ubuntu Pro 18.04 LTS 5:4.0.9-1ubuntu0.2+esm6

ubuntu advisories UBUNTU-CVE-2025-49844

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • valkey RHEL 10.1 8.0.6-2.el10_1
  • valkey RHEL 9 8.0.6-2.el9_7
  • redis RHEL 9 7.2.11-1.module+el9.7.0+23559+d075163a
  • redis RHEL 9 6.2.20-2.el9_7
  • valkey RHEL 10.0 8.0.6-1.el10_0
  • redis RHEL 9 7.2.11-1.module+el9.6.0+23552+a3d3d132
  • redis RHEL 9 6.2.20-1.el9_6
  • redis RHEL 8 6.2.20-1.module+el8.10.0+23551+d4cd15d7

red hat advisories RHSA-2025:21936RHSA-2025:21916RHSA-2025:20955RHSA-2025:20926RHSA-2025:19675RHSA-2025:19399

  • valkey SLES for SAP applications 16.0, SLES 16.0 8.0.6-160000.1.1
  • redis SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE High Performance Computing 15 SP3-LTSS +1 more 6.0.14-150200.6.43.1
  • redis SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +7 more 6.2.6-150400.3.40.1
  • redis SLE Module for Server Applications 15 SP6, openSUSE Leap 15.6 7.2.4-150600.3.18.1
  • valkey SLE Module for Server Applications 15 SP7 8.0.6-150700.3.11.1
  • redis7 SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE High Performance Computing 15 SP5-LTSS +1 more 7.0.8-150500.3.24.1
  • redis7 SLE Module for Server Applications 15 SP6, openSUSE Leap 15.6 7.0.8-150600.8.19.1
  • valkey SLE Module for Server Applications 15 SP6, openSUSE Leap 15.6 8.0.6-150600.13.17.1

suse advisories SUSE-SU-2026:20022-1SUSE-SU-2025:03507-1SUSE-SU-2025:03506-1SUSE-SU-2025:03505-1SUSE-SU-2025:03502-1SUSE-SU-2025:03501-1

  • valkey openSUSE Leap 16.0 8.0.6-160000.1.1
  • redis openSUSE Leap 16.0 8.2.3-bp160.1.1
  • valkey openSUSE Tumbleweed 8.1.4-1.1
  • redis openSUSE Tumbleweed 8.2.2-1.1

opensuse advisories openSUSE-SU-2026:20003-1openSUSE-SU-2025:20121-1openSUSE-SU-2025:15604-1openSUSE-SU-2025:15600-1

  • valkey AlmaLinux 9 8.0.6-2.el9_7
  • valkey AlmaLinux 10 8.0.6-2.el10_1
  • redis AlmaLinux 9 6.2.20-2.el9_7
  • redis AlmaLinux 9 7.2.11-1.module_el9.6.0+188+92104ce8
  • valkey AlmaLinux 10 8.0.6-1.el10_0
  • redis AlmaLinux 9 6.2.20-1.el9_6
  • redis AlmaLinux 8 6.2.20-1.module_el8.10.0+4056+739731b0

almalinux advisories ALSA-2025:21916ALSA-2025:21936ALSA-2025:20926ALSA-2025:20955ALSA-2025:19675ALSA-2025:19345

  • redis Rocky Linux 9 7.2.11-1.module+el9.7.0+40013+17379f63
  • redis Rocky Linux 8 6.2.20-1.module+el8.10.0+2081+450a296c
  • valkey Rocky Linux 10 8.0.6-2.el10_1
  • valkey Rocky Linux 9 8.0.6-2.el9_7
  • redis Rocky Linux 9 6.2.20-2.el9_7
  • valkey Rocky Linux 10 8.0.6-1.el10_0
  • redis Rocky Linux 9 6.2.20-1.el9_6

rocky linux advisories RLSA-2025:19345RLSA-2025:20955RLSA-2025:19238RLSA-2025:21936RLSA-2025:21916RLSA-2025:20926

  • redis Alpine 3.21 7.2.11-r0
  • redis Alpine 3.22 8.0.4-r0
  • redis Alpine 3.24, Alpine 3.23 8.2.2-r0
  • redict Alpine 3.24, Alpine 3.23, Alpine 3.22 7.3.6-r0
  • valkey Alpine 3.21, Alpine 3.20 7.2.11-r0
  • valkey Alpine 3.24, Alpine 3.23, Alpine 3.22 8.1.4-r0

alpine advisories ALPINE-CVE-2025-49844

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • redis CBL-Mariner 2.0 6.2.20-1
  • valkey Azure Linux 3.0 8.0.6-1

azure linux advisories AZL-68226AZL-68426

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-49844 updated cvss 8.8

Redis: Redis Lua Use-After-Free may lead to remote code execution

  • Red Hat Enterprise Linux AppStream (v. 8) redis 6.2.20-1.module+el8.10.0+23551+d4cd15d7
    fixed: vendor fix RHSA-2025:19238
  • Red Hat Enterprise Linux AppStream (v. 9) redis 6.2.20-1.el9_6, redis 6.2.20-2.el9_7, valkey 8.0.6-2.el9_7, redis 7.2.11-1.module+el9.6.0+23552+a3d3d132, redis 7.2.11-1.module+el9.7.0+23559+d075163a
    fixed: vendor fix RHSA-2025:19237
  • Red Hat Enterprise Linux AppStream (v. 10) valkey 8.0.6-1.el10_0, valkey 8.0.6-2.el10_1
    fixed: vendor fix RHSA-2025:19675
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) redis 6.0.9-5.module+el8.4.0+23585+fb4eb024.5
    fixed: vendor fix RHSA-2025:19318
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) redis 6.0.9-5.module+el8.6.0+23584+001f3496.6 Red Hat Enterprise Linux AppStream E4S (v.8.6) redis 6.0.9-5.module+el8.6.0+23584+001f3496.6
    fixed: vendor fix RHSA-2025:19239
  • Red Hat Enterprise Linux AppStream E4S (v.8.8) redis 6.2.7-1.module+el8.8.0+23580+a818c120.6
    fixed: vendor fix RHSA-2025:19399
  • Red Hat Enterprise Linux AppStream E4S (v.9.0) redis 6.2.6-1.el9_0.5
    fixed: vendor fix RHSA-2025:18997
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) redis 6.2.7-1.el9_2.5
    fixed: vendor fix RHSA-2025:19086
show 8 more
  • Red Hat Enterprise Linux AppStream EUS (v.9.4) redis 6.2.7-1.el9_4.5, redis 7.0.12-2.module+el9.4.0+23556+1eb46139.6
    fixed: vendor fix RHSA-2025:18996
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) redis 6.0.9-5.module+el8.4.0+23585+fb4eb024.5
    fixed: vendor fix RHSA-2025:19318
  • Red Hat Enterprise Linux AppStream TUS (v.8.6) redis 6.0.9-5.module+el8.6.0+23584+001f3496.6
    fixed: vendor fix RHSA-2025:19239
  • Red Hat Enterprise Linux AppStream TUS (v.8.8) redis 6.2.7-1.module+el8.8.0+23580+a818c120.6
    fixed: vendor fix RHSA-2025:19399
  • Red Hat OpenShift GitOps 1.16 openshift-gitops-1
    fixed: vendor fix RHSA-2025:23207
  • Red Hat OpenShift GitOps 1.17 openshift-gitops-1
    fixed: vendor fix RHSA-2025:23206
  • Red Hat OpenShift GitOps 1.18 openshift-gitops-1
    fixed: vendor fix RHSA-2025:23203
  • Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/vector-rhel9, openshift-logging/fluentd-rhel9, openshift-logging/eventrouter-rhel9, openshift-logging/logging-view-plugin-rhel9, openshift-logging/cluster-logging-rhel9-operator, openshift-logging/log-file-metric-exporter-rhel9, +1 more Red Hat AI Inference Server rhaiis/vllm-tpu-rhel9, rhaiis/vllm-cuda-rhel9, rhaiis/vllm-rocm-rhel9, rhaiis/vllm-spyre-rhel9, rhaiis-preview/vllm-cuda-rhel9 Red Hat Ansible Automation Platform 2 automation-controller, ansible-automation-platform/ee-minimal-rhel8, ansible-automation-platform/ee-minimal-rhel9, ansible-automation-platform-24/de-minimal-rhel8, ansible-automation-platform-24/de-minimal-rhel9, ansible-automation-platform-24/ee-minimal-rhel8, +27 more Red Hat Connectivity Link 1 rhcl-1/limitador-rhel9 Red Hat Developer Hub 1 rhdh/rhdh-hub-rhel9 Red Hat Discovery 1 discovery/discovery-server-rhel9
    +11 more products
    Red Hat Discovery 2 discovery/discovery-server-rhel9 Red Hat Enterprise Linux AI (RHEL AI) rhelai1/bootc-amd-rhel9, rhelai1/bootc-azure-amd-rhel9, rhelai1/instructlab-amd-rhel9 Red Hat OpenShift AI (RHOAI) rhoai/odh-feature-server-rhel9, rhoai/odh-llama-stack-core-rhel9 Red Hat OpenShift Container Platform 4 openshift4/ose-ironic-rhel9, openshift4/ose-ironic-agent-rhel9 Red Hat OpenShift GitOps argocd-rhel8, argocd-rhel9 Red Hat OpenShift GitOps 1.16 openshift-gitops-1 Red Hat OpenShift GitOps 1.17 openshift-gitops-1 Red Hat OpenShift GitOps 1.18 openshift-gitops-1 Red Hat OpenStack Platform 13 (Queens) rhosp13/openstack-zaqar, rhosp13/openstack-ec2-api, rhosp13/openstack-horizon, rhosp13/openstack-tempest, rhosp13/openstack-aodh-api, rhosp13/openstack-collectd, +83 more Red Hat Quay 3 quay/quay-rhel8 Red Hat Satellite 6 python-redis, python3-redis, rubygem-redis, python-aioredis, python3-aioredis, satellite/iop-advisor-engine-rhel9
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-26-083-03 updated cvss 10.0

"Schneider Electric Plant iT/Brewmaxx"

  • Schneider Electric Plant iT/Brewmaxx >= 9.60
    affected: vendor fix proleit.com
  • Schneider Electric Plant iT/Brewmaxx ProLeiT
    fixed

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
7 mo ago

Exploit prediction

82.64% chance of exploitation in the next 30 days, higher than 99.6% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • Nuclei template Redis Lua Parser < 8.2.2 - Use After Free nuclei detection template
  • github.com https://github.com/lastvocher/redis-CVE-2025-49844 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 10.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
NVD 3.1 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
OSV 3.1 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
bitnami keydb
<6.2.20
>=7.0.0, <7.2.11
>=7.3.0, <7.4.6
>=8.0.0, <8.0.4
>=8.1.0, <8.2.2
6.2.20
7.2.11
7.4.6
8.0.4
8.2.2
bitnami redis
<6.2.20
>=7.0.0, <7.2.11
>=7.3.0, <7.4.6
>=8.0.0, <8.0.4
>=8.1.0, <8.2.2
6.2.20
7.2.11
7.4.6
8.0.4
8.2.2
bitnami valkey
<7.2.11
>=8.0.0, <8.0.6
>=8.1.0, <8.1.4
7.2.11
8.0.6
8.1.4

Affected products

  • redis redis

Classification

Weakness
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

The maintainers of redis/redis published their own advisory on GitHub. Reviewed sources take precedence over it.

CPEs and fixed versions use Anchore's correction of NVD's data: Add valkey.