CVE-2025-49844
BaseFortify
Publication date: 2025-10-03
Last updated on: 2026-03-20
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| redis | redis | From 7.0.0 (inc) to 7.2.9 (inc) |
| redis | redis | From 7.0.0 (inc) to 7.2.9 (inc) |
| lfprojects | valkey | to 7.2.11 (exc) |
| lfprojects | valkey | From 8.0.0 (inc) to 8.0.6 (exc) |
| lfprojects | valkey | From 8.1.0 (inc) to 8.1.4 (exc) |
| redis | redis | From 7.0.0 (inc) to 7.2.9 (inc) |
| redis | redis | From 7.0.0 (inc) to 7.2.9 (inc) |
| redis | redis | From 7.0.0 (inc) to 7.2.9 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-416 | The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Redis versions 8.2.1 and below allows an authenticated user to exploit a specially crafted Lua script to manipulate the garbage collector, causing a use-after-free condition that can potentially lead to remote code execution. It affects all Redis versions with Lua scripting enabled and is fixed in version 8.2.2.
How can this vulnerability impact me? :
If exploited, this vulnerability can allow an attacker with authentication to execute arbitrary code remotely on the Redis server, potentially leading to full system compromise, data loss, or unauthorized access.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability immediately, you should prevent users from executing Lua scripts by using Access Control Lists (ACL) to restrict the EVAL and EVALSHA commands. Alternatively, upgrade Redis to version 8.2.2 or later where the issue is fixed.