CVE 2025 49844

nvd.nist.gov • June 28, 2026

This CVE record has been updated after NVD enrichment efforts were completed. Enrichment data supplied by the NVD may require amendment due to these changes.

Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.

Denotes Vulnerable Software Are we missing a CPE here? Please let us know .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Redis Lua Use-After-Free RCE Vulnerability Exploited CVE-2025-49844 is a critical use-after-free vulnerability in the Redis Lua interpreter, affecting all versions up to 8.2.1. Authenticated attackers can exploit this flaw by sending a crafted EVAL command that manipulates the garbage collector, potentially leading to remote code execution. The vulnerability has a CVSS score of 10.0, indicating its severity. Affected systems include unencrypted Redis instances, with over 8,500 identified as vulnerable as of October 2025. The issue has been patched in version 8.2.2, and users are advised to restrict Lua script execution as a workaround. The vulnerability was first publicly disclosed in 2019, with a proof of concept released shortly after. Organizations using Redis are urged to apply the patch or implement access controls to mitigate risks. 2 sources 73

Extracted Entities

CVE 2025 49844

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (1)