Latest Redis vulnerabilities #
Redis has disclosed (GHSA-4789-qfc9-5f9q, GHSA-m8fj-85cg-7vhp, GHSA-qrv7-wcrx-q5jp, GHSA-4c68-q8q8-3g4f) four vulnerabilities in certain versions of the database server's Lua scripting functionality.
- A remote, low-privileged adversary may use a specially crafted Lua script to manipulate the garbage collector, triggering a use-after-free vulnerability that could lead to remote code execution (RCE). This vulnerability has been designated CVE-2025-49844 and has been rated critical with a CVSS score of 10.0.
- A local, low-privileged adversary may use a specially crafted Lua script to cause an integer overflow that could lead to RCE. This vulnerability has been designated CVE-2025-46817 and has been rated high with a CVSS score of 7.0.
- A local, low-privileged adversary may use a specially crafted Lua script to manipulate different Lua objects and potentially execute arbitrary code in the context of another user. This vulnerability has been designated CVE-2025-46818 and has been rated medium with a CVSS score of 6.0.
- A local, low-privileged adversary may use a specially crafted Lua script to read out-of-bounds data or crash the server causing a denial-of-service (DoS). This vulnerability has been designated CVE-2025-46819 and has been rated medium with a CVSS score of 6.3.
The following Redis OSS (Open Source Software), Community Edition (CE) and Stack releases are affected
- Redis OSS/CE 6.2.x versions prior to 6.2.20
- Redis OSS/CE 7.2.x versions prior to 7.2.11
- Redis OSS/CE 7.4.x versions prior to 7.4.6
- Redis OSS/CE 8.0.x versions prior to 8.0.4
- Redis OSS/CE 8.2.x versions prior to 8.2.2
- Redis Stack 7.2.x versions prior to 7.2.0-v19
- Redis Stack 7.4.x versions prior to 7.4.0-v7
The following Redis Enterprise software releases are affected
- Redis 6.4.x versions prior to 6.4.2-131
- Redis 7.2.x versions prior to 7.2.4-138
- Redis 7.4.x versions prior to 7.4.6-272
- Redis 7.8.x versions prior to 7.8.6-207
- Redis 7.22.x versions prior to 7.22.2-12
What is the impact? #
Successful exploitation of these vulnerabilities would allow an adversary to execute arbitrary code on the vulnerable host, potentially leading to complete system compromise.
Are updates or workarounds available? #
Users are encouraged to update to the latest version as quickly as possible.
Upgrade all affected Redis OSS (Open Source Software), Community Edition (CE) and Stack releases to the new versions:
- Redis OSS/CE 6.2.x upgrade to version 6.2.20 or later
- Redis OSS/CE 7.2.x upgrade to version 7.2.11 or later
- Redis OSS/CE 7.4.x upgrade to version 7.4.6 or later
- Redis OSS/CE 8.0.x upgrade to version 8.0.4 or later
- Redis OSS/CE 8.2.x upgrade to version 8.2.2 or later
- Redis Stack 7.2.x upgrade to version 7.2.0-v19 or later
- Redis Stack 7.4.x upgrade to version 7.4.0-v7 or later
Upgrade all affected Redis Enterprise software releases to the new versions:
- Redis 6.4.x upgrade to version 6.4.2-131 or later
- Redis 7.2.x upgrade to version 7.2.4-138 or later
- Redis 7.4.x upgrade to version 7.4.6-272 or later
- Redis 7.8.x upgrade to version 7.8.6-207 or later
- Redis 7.22.x upgrade to version 7.22.2-12 or later
How to find potentially vulnerable systems with runZero #
From the Software Inventory, use the following query to locate potentially impacted assets:
vendor:=Redis AND product:=Redis AND (version:>0 AND (
(version:>=6.2 AND version:<6.2.20) OR
(version:>=7.2 AND version:<7.2.11) OR
(version:>=7.4 AND version:<7.4.6) OR
(version:>=8.0 AND version:<8.0.4) OR
(version:>=8.2 AND version:<8.2.2)))
