Security Digest · Oct 3, 2025 · Vulnerability · Database
RediShell: 13-Year-Old Lua Use-After-Free RCE in Redis
CVE-2025-49844 lets an authenticated Redis user escape Lua and run code on the host. Fixed in 8.2.2/8.0.4/7.4.6/7.2.11/6.2.20. Urgent if exposed or no auth.
Our verdict
Patch this week
Exploitation needs an authenticated session, so properly locked-down Redis can be patched in a normal urgent window; instances reachable without a password are effectively unauthenticated RCE and should be fixed today.
Who must act: Anyone self-hosting Redis with Lua scripting (the default) below the fixed versions, first of all instances that are internet-reachable or have no requirepass/ACLs.
Who can relax: Redis Cloud users (patched by Redis) and teams whose Redis is private, authenticated, and only used by trusted application code, though they should still upgrade.
- Affected
- Redis OSS/CE with Lua scripting before 8.2.2, 8.0.4, 7.4.6, 7.2.11, 6.2.20
Redis Stack before 7.4.0-v7 and 7.2.0-v19
Redis Software before 7.22.2-20, 7.8.6-207, 7.4.6-272, 7.2.4-138, 6.4.2-131 - Fixed in
- Redis OSS/CE 8.2.2, 8.0.4, 7.4.6, 7.2.11, 6.2.20
Redis Stack 7.4.0-v7, 7.2.0-v19
Redis Software 7.22.2-20, 7.8.6-207, 7.4.6-272, 7.2.4-138, 6.4.2-131 - CVSS
- 10.0 (v3.1, CNA)
- EPSS
- 82.3% (percentile 99.7)
- CISA KEV
- Not listed
- Exploitation
- No known exploitation
- Severity
- Critical
What to do
- Check versions: redis-cli INFO server | grep redis_version (and image tags for containers)
- Upgrade to a fixed release for your line; for Redis Software use 7.22.2-20 or later (earlier advisory text wrongly named -12/-14)
- If you cannot patch yet, block Lua via ACL, e.g. ACL SETUSER <user> -eval -evalsha (and the script/function commands you do not use)
- Make sure every instance requires authentication (requirepass or ACL users) and has protected-mode on
- Remove internet exposure: bind to private interfaces and firewall port 6379
- Run redis-server as a dedicated non-root user
How to check if you are affected or compromised
- Find instances answering PING without AUTH from outside their intended network
- Look for unexpected EVAL/EVALSHA usage or unknown scripts (SCRIPT, FUNCTION LIST) in MONITOR samples or command stats (INFO commandstats)
- Investigate redis-server crashes with stack traces in the Lua engine
- Look for child processes, outbound connections or file changes made by the redis user
What happened#
On October 3, 2025, Redis published fixes for CVE-2025-49844, a use-after-free in the Lua scripting engine bundled with redis-server. Per the CVE record, an authenticated user can send "a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code execution." That means code execution on the host, outside the Lua sandbox. Wiz researchers found it and demonstrated it at Pwn2Own Berlin in May 2025, working with Trend Micro's Zero Day Initiative. Wiz named it RediShell and says the bug had been in the codebase for about 13 years.
Scores vary. The CVE record and Redis's advisory say CVSS 10.0, while the GitHub advisory lists 9.9 with the same vector. Either way, it is critical.
Who is affected#
The CVE record says every Redis version with Lua scripting, which is on by default, is affected up to 8.2.1. Fixed open-source releases are 8.2.2, 8.0.4, 7.4.6, 7.2.11 and 6.2.20. Redis Stack is fixed in 7.4.0-v7 and 7.2.0-v19. Redis Software is fixed in 7.22.2-20, 7.8.6-207, 7.4.6-272, 7.2.4-138 and 6.4.2-131. Redis corrected its advisory twice in late October 2025: 7.22.2-12 and 7.22.2-14 are not fixed. Redis Cloud subscriptions were patched by Redis. Wiz notes that forks such as Valkey and managed services like ElastiCache, Memorystore and Azure Cache for Redis carry the same Lua code. Check your provider's bulletin for its fixed versions.
Do you really need to act?#
The honest answer turns on authentication. On paper, an attacker needs a valid Redis login, so a private, password-protected instance used only by your own app is a post-compromise risk. It is serious, but not a fire. Redis says it has "no evidence of exploitation" in Redis Cloud or in customer environments. As of this writing, CISA has not listed the CVE as exploited. CISA's assessment in the CVE record is "proof of concept."
Real-world Redis is often not locked down. Wiz counted about 330,000 internet-exposed Redis instances, around 60,000 of them with no authentication at all. On those, "authenticated" means "anyone." Redis is also a common lateral-movement target inside clusters, where many pods share one password. Upgrade those instances immediately, and fix everything else within days.
What to do now#
- Inventory versions:
redis-cli INFO server | grep redis_version, plus the image tags in your manifests and Helm charts. - Upgrade to a fixed release for your line. Bump the image tag and roll the deployment.
- If patching must wait, deny scripting with ACLs, as the GitHub advisory suggests. For example:
ACL SETUSER app -eval -evalsha, then persist withACL SAVEor update your config. Confirm your app does not rely on Lua first, because some queue and rate-limit libraries do. - Require authentication everywhere (
requirepassor ACL users) and keepprotected-mode yes. - Bind Redis to private interfaces, firewall port 6379, and run it as a non-root user so a successful escape gains less.
How to tell if you were hit#
Redis's advisory lists indicators to check: access from unknown sources, unexpected use of scripting commands, unknown scripts stored in the database, and crashes with a stack trace originating in the Lua engine. It also lists unexpected commands run by the redis-server user, odd egress traffic, and changes in Redis data or config directories. INFO commandstats shows whether eval/evalsha have been called on instances where your app never uses them. On the host, look for shells or downloaders spawned by redis-server.
Timeline#
- — Wiz reports the bug to Redis at Pwn2Own Berlin.
- — Redis publishes the advisory, GHSA and fixed releases.
- — Wiz publishes RediShell research and exposure figures.
- and — Redis corrects the Redis Software fixed version to 7.22.2-20.
Vulnerability records
- CVE-2025-49844 · Redis is an open source, in-memory database that persists on disk.
Sources
Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.