External risk intelligence

Redis Lua Scripting Use-After-Free Leading to Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2025-49844

Redis is a database typically deployed within internal network segments, protected by firewalls, and not intended for direct exposure to the public internet. While it supports network connectivity, it is rarely configured as a public-facing service in standard architectures, and this vulnerability requires prior authentication, further limiting the risk of unauthorized external access.

Use After Free

Redis

before 6.2.207.0 to before 7.2.117.4.0 to before 7.4.68.0.0 to before 8.0.48.2.0 to before 8.2.2before 7.2.118.0.0 to before 8.0.68.1.0 to before 8.1.4

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in Redis, an in-memory database, affecting its Lua scripting functionality. This flaw could allow authenticated users to execute arbitrary code on affected systems. While the primary concern is confirming relevance and exposure, it is important for leadership to be aware of potential risks to data integrity and system availability.

Authenticated users could run malicious code.
It impacts a widely used database technology.
Confirm exposure and assess business risk.

Attack Path

How an attacker could exploit the issue

An attacker with authenticated access to Redis can execute a specially crafted Lua script. This script manipulates the garbage collector, leading to a use-after-free vulnerability. If successful, this could allow an attacker to achieve remote code execution.

Requires authenticated access.
Triggered by a crafted Lua script.
Potential for remote code execution.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, an authenticated user could leverage a specially crafted Lua script to manipulate Redis's garbage collector. This manipulation may trigger a use-after-free vulnerability, potentially allowing for remote code execution on the affected system.

Redis data and system integrity.
Authenticated user executes malicious Lua script.
Remote code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

Teams responsible for Redis or Valkey instances, often application or platform owners, must identify affected deployments. Prioritize review of instances exposed to or utilized by critical business functions. Develop a remediation plan based on the risk assessment, considering vendor coordination or temporary control measures if immediate patching is not feasible.

Application or platform teams own the issue.
Verify instance exposure and business criticality.
Plan remediation considering vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Redis and how is it used?

Redis is an open-source, in-memory data store that keeps information in RAM for high-speed access while maintaining the ability to persist data to disk. It acts as a database, cache, or message broker, often serving as a foundational piece of infrastructure for web applications that require rapid data retrieval and complex scripting capabilities.

What is the vulnerability class for CVE-2025-49844?

The flaw is categorized as a use-after-free vulnerability, identified as CWE-416. In plain terms, this means the software attempts to access a specific memory location after that memory has already been cleared or released. In this instance, a specifically designed Lua script tricks the database's internal garbage collector, which can allow an unauthorized attacker to take control of the system through remote code execution.

How is this Redis vulnerability triggered?

An attacker must have valid credentials to authenticate to the Redis instance to launch the attack. They trigger the flaw by submitting a specially crafted Lua script designed to manipulate the memory management system. It is important to note that if an environment does not permit users to run Lua scripts, or if the Lua scripting functionality is disabled entirely, this specific path to code execution cannot be initiated.

Is my Redis instance at risk?

Halo Surface Signal notes that Redis is typically hosted within internal network segments and protected by firewalls, making direct public-internet exposure rare. Because this vulnerability requires prior authentication, the risk is higher for environments where many users have access to run scripts on the database, rather than systems locked behind strict, segmented, or private network boundaries.

How do I secure my environment against this issue?

The primary fix is to update your Redis or Valkey software to a patched version, such as Redis 8.2.2. If you cannot update immediately, you can implement a temporary workaround by modifying your Access Control List (ACL) to disable the EVAL and EVALSHA commands. This prevents any user from executing Lua scripts, effectively removing the trigger mechanism for this vulnerability until a permanent update can be deployed.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.