13-Year-Old Redis RCE Flaw Lets Attackers Seize Complete Host Control

A remote code execution vulnerability in Redis, designated CVE-2025-49844 and nicknamed RediShell, has been described as a modern security crisis by Wiz Research, which uncovered a Use-After-Free memory corruption bug present in Redis for about 13 years. According to Wiz Research, the flaw allows authenticated attackers to send crafted Lua scripts that escape Redis’s Lua sandbox and achieve arbitrary native code execution on the host system, enabling complete control over the Redis host.

The advisory notes the vulnerability carries the maximum CVSS 3.1 score of 10.0 and affects all Redis versions worldwide, with exploitation possible via the network after post-authentication access. Redis published a security advisory on 3 October 2025 alongside patched versions.

Security researchers estimate Redis operates in around 75% of cloud environments, while Wiz Research analysis indicates about 330,000 Redis instances are exposed to the internet, including around 60,000 installations with no authentication configured; the official Redis container image is used in 57% of cloud environments and does not require authentication by default.