Critical Flaw CVE-2025-49844 (CVSS 10.0) Allows Remote Code Execution in Redis

A critical vulnerability in Redis, CVE-2025-49844, has a CVSS score of 10.0 and can enable remote code execution through the Lua scripting engine. The flaw is one of four Lua-related vulnerabilities (CVE-2025-46817, CVE-2025-46818, CVE-2025-46819, and CVE-2025-49844) that affect all Redis versions with Lua scripting enabled, with patches issued in versions 6.2.20, 7.2.11, 7.4.6, 8.0.4, and 8.2.2.

According to Redis’ advisory, an authenticated user may use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code execution. Redis also advises restricting EVAL, EVALSHA, and FUNCTION commands via ACLs as a mitigation, alongside upgrading to the patched versions and other defensive steps such as network segmentation and monitoring for unusual Lua activity.

The article notes that the issue could allow attackers to execute arbitrary code within the Redis server process and potentially move laterally across connected systems.