CVE-2025-49844 in Redis: why a Lua flaw can end up in remote execution

Published on 2026-10-27 by frfrand

What RediShell means in Redis, who reported it, access requirements, patched versions, and measures to protect a service.

Can Redis also have critical vulnerabilities?

Yes. Redis is used as a cache, session store, queue, or database in thousands of systems. CVE-2025-49844, disclosed in October 2025 and nicknamed in some analyses RediShell, was rated with CVSS 10.0 by the vendor because, in a possible scenario, it could end in remote code execution.

What was failing inside Redis?

The problem resided in the engine that executes Lua scripts. Incorrect memory handling called use-after-free can cause the program to attempt to use information after freeing the space where it was stored. Under certain conditions this allows altering the normal execution flow.

Who found and reported the flaw?

Redis credits Benny Isaacs, Nir Brakha and Sagi Tzadik, researchers from Wiz in collaboration with Trend Micro Zero Day Initiative. The coordinated disclosure process allowed preparing fixes before giving public details of the scope. Analyzing memory, garbage collection, and interpreter limits was central in this case.

How could it be exploited?

Requires authenticated access to Redis, according to its official bulletin. A user with the necessary capabilities could introduce a manipulated Lua script that interacts abnormally with the garbage collector and triggers the failure. This is different from saying that «anyone on the Internet can take any Redis». An instance directly exposed, with leaked credentials or overly broad permissions, increases the risk.

Why would it be so serious?

Redis usually accesses session information, temporary keys, and internal tasks. If an attacker manages to execute code within the process, they can affect the integrity and availability of the machine according to their permissions. The fact that the attack has an authentication precondition does not make it irrelevant: stolen credentials or a previously compromised application could provide that access.

Which versions had the fix?

Redis published patched versions in different branches of Redis OSS/Community Edition and Redis Software. For OSS/CE, the advisory lists 8.2.2, 8.0.4, 7.4.6 and 7.2.11 as the first fixed milestones of those series. There are also different lines in Redis Software and Redis Stack, so there is no single version that covers all products. Always check the official table before planning the upgrade.

How do I check my Redis?

Identify the version and edition that is actually running. Check which networks have access to the service port, users and ACL rules, services that can invoke Lua, and logs of unusual connections and commands. The provider mentions possible indicators such as unknown scripts, process crashes, anomalous traffic, and unexpected service user activity. These are clues to investigate, not conclusive evidence on their own.

How do I fix it and reduce risk?

Update to a patched and maintained release. Restrict connections via private networks, firewall, and access policies; use strong authentication and roles with minimum privileges; do not expose Redis indiscriminately to the Internet. Before making changes, record configuration and appropriate backups, test persistence, and verify connectivity from applications.

Frequently asked questions

If Redis requires a password, am I already protected? No: the exploitation condition includes authentication.

Does disabling Lua suffice? It may reduce certain paths, but it does not replace the update and depends on the functionalities your application uses.

Did Redis Cloud need a manual patch? The provider indicated that its at-risk subscriptions were fixed by the service; self-managed instances must be evaluated.

Sources: Official Redis advisory and fixed versions · CVE Record.

Where to follow CVE alerts and receive guidance?

On ArduMaker CVE and support we publish updates and centralize inquiries about vulnerabilities, starting with WordPress and its related technologies. If your case involves another runtime or a database, specify component, version, operating system, and service exposure to contextualize it. The notice of a CVE does not prove that your server is compromised: evaluation requires inventory, configuration, and evidence.

Editorial note — October 2026: these fixed versions are the milestones of the original advisory. When updating today, choose a branch with active support and verify the manufacturer's current announcement.

Practical example: Redis exposed more than necessary

Situation: an application uses Redis for sessions and cache, but the administrator discovers that port 6379 is listening on a public interface. This configuration issue is not identical to CVE-2025-49844, but it facilitates reaching a service that should have restricted access.

On the VPS itself:

ss -lntp | grep ':6379'

With an authorized Redis session, check version and edition:

redis-cli INFO server

Do not paste passwords on the command line nor share the result if it contains internal information.

Before: Redis accessible from unnecessary networks, generic roles and outdated version. After: private network, firewall, authentication and minimal ACLs, patched runtime and verification that the app can still connect.

Example impact: if someone obtains Redis credentials with broad permissions, a vulnerability in the script interpreter can increase the consequences of access. The password alone does not eliminate the need to update.