CVE-2025-49844: RCE in Redis 8.2.2 via Lua Script

The impact of CVE-2025-49844 is severe due to the potential for Remote Code Execution. An attacker, having valid authentication credentials, could inject a malicious Lua script that manipulates Redis's garbage collection process. This manipulation can trigger a use-after-free error, allowing the attacker to overwrite memory and ultimately execute arbitrary code on the Redis server. The blast radius extends to any data stored within Redis, as an attacker could potentially read, modify, or delete sensitive information. Furthermore, if Redis is used as a caching layer or session store for other applications, a successful exploit could lead to lateral movement and compromise of those applications as well. This vulnerability shares similarities with other memory corruption vulnerabilities where crafted scripts can bypass security controls.

1. Reserved2025-06-11
2. Published2025-10-03
3. Modified2026-03-20
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-49844 is to upgrade to Redis version 8.2.2 or later, which contains the fix. If immediate patching is not possible, a workaround involves restricting user access to Lua scripting capabilities. This can be achieved by implementing Access Control Lists (ACLs) to deny the EVAL and EVALSHA commands. These commands are the primary vectors for executing malicious Lua scripts. Carefully review existing Lua scripts to ensure they are not vulnerable. After upgrading, confirm the fix by attempting to execute a known vulnerable Lua script and verifying that it is rejected or fails with an appropriate error message.