Redis Server Use-After-Free Vulnerability Allows Remote Code Execution

A critical security vulnerability has been identified in Redis Server, allowing authenticated attackers to achieve remote code execution via a use-after-free flaw in the Lua scripting engine.

The vulnerability, designated as CVE-2025-49844 , affects all Redis versions supporting Lua scripting functionality.

Critical Memory Corruption Flaw Discovered

Security researchers have pinpointed this severe vulnerability, which exploits Redis's garbage collection mechanism. The flaw enables authenticated users to create malicious Lua scripts that manipulate the garbage collector, triggering a use-after-free condition, potentially leading to arbitrary code execution on the target system.

CVE ID: CVE-2025-49844 Vulnerability Type: Use-After-Free (CWE-416) Impact: Remote Code Execution CVSS 3.1 Score: 10.0 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Severity: Critical

The vulnerability arises from improper memory management in Redis's Lua scripting implementation, where memory references can persist after the garbage collector has freed the underlying memory structures. This condition allows attackers to potentially control freed memory regions and execute arbitrary code with the privileges of the Redis server process.

This issue poses significant risks to organizations using Redis, particularly those permitting authenticated users to execute Lua scripts. Attackers with valid Redis credentials can exploit this flaw remotely over network connections without needing additional user interaction or elevated privileges.

The attack complexity is considered low, suggesting that exploitation techniques may be straightforward once the vulnerability details become widely known. The changed scope rating indicates that successful exploitation could impact resources beyond the Redis server itself, potentially affecting other systems or data within the same security boundary.

While patches are under development, Redis administrators can implement immediate protective measures. The primary workaround involves using Access Control Lists (ACLs) to restrict the EVAL and EVALSHA commands, effectively preventing users from executing Lua scripts. This mitigation strategy eliminates the attack vector while maintaining other Redis functionality.

Organizations should review their Redis configurations to identify instances where Lua scripting is enabled and assess whether this functionality is essential. Those who can disable Lua scripting should implement ACL restrictions immediately as a temporary security measure.

Based on reporting by GBHackers.