13-Year Redis Flaw Exposed: CVSS 10.0 Vulnerability Lets Attackers Run Code Remotely

Redis has disclosed a maximum-severity vulnerability tracked as CVE-2025-49844 (aka RediShell) that could allow remote code execution under certain conditions, with an authenticated user able to use a specially crafted Lua script to manipulate the garbage collector and trigger a use-after-free.

The issue exists in all versions of Redis with Lua scripting, and remediation requires an authenticated Redis instance; administrators are urged to avoid exposing RedisInstances to the internet and to use strong authentication. The flaw, described by Wiz as a use-after-free memory corruption bug that has existed in the Redis source for about 13 years, has been addressed in versions 6.2.20, 7.2.11, 7.4.6, 8.0.4 and 8.2.2 released on 3 October 2025.

Temporary mitigations include preventing users from executing Lua scripts by limiting EVAL and EVALSHA via an ACL. As of writing, around 330,000 Redis instances are exposed to the internet, with about 60,000 lacking any authentication, underscoring the urgency of remediation according to Wiz and Redis’ security advisory, according to GitHub advisory.