Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.
References
| Link | Resource |
|---|---|
| https://github.com/redis/redis/commit/d5728cb5795c966c5b5b1e0f0ac576a7e69af539 | Patch |
| https://github.com/redis/redis/releases/tag/8.2.2 | Release Notes |
| https://github.com/redis/redis/security/advisories/GHSA-4789-qfc9-5f9q | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
16 Oct 2025, 16:28
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Lfprojects valkey
Lfprojects |
|
| CPE | cpe:2.3:a:lfprojects:valkey:*:*:*:*:*:*:*:* |
06 Oct 2025, 18:47
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/redis/redis/commit/d5728cb5795c966c5b5b1e0f0ac576a7e69af539 - Patch | |
| References | () https://github.com/redis/redis/releases/tag/8.2.2 - Release Notes | |
| References | () https://github.com/redis/redis/security/advisories/GHSA-4789-qfc9-5f9q - Third Party Advisory | |
| First Time |
Redis redis
Redis |
|
| CPE | cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:* |
03 Oct 2025, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-10-03 20:15
Updated : 2025-10-16 16:28
NVD link : CVE-2025-49844
Mitre link : CVE-2025-49844
CVE.ORG link : CVE-2025-49844
JSON object : View
Products Affected
lfprojects
- valkey
redis
- redis
CWE
CWE-416
Use After Free