CVE-2022-0543: Debian-packaged Redis Lua sandbox escape allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 10.0, confirmed exploitation in CISA KEV, and near-certain EPSS probability make this an urgent remote code execution risk.

What it is

A Debian-specific packaging flaw in Redis leaves the Lua interpreter's sandbox improperly restricted, allowing escape from the Lua sandbox. Because Redis is a network-facing key-value database, this escape can lead to remote code execution on the host. The issue is a packaging defect rather than an upstream Redis code bug, so only Debian-built packages are affected.

Impact

An attacker who can reach the Redis service can break out of the Lua sandbox and execute arbitrary code with the privileges of the Redis process. This gives full control of the Redis host, including data access and potential lateral movement.

Attack surface

Reached over the network via the Redis service, as reflected by the CVSS vector AV:N/PR:N/UI:N, meaning no authentication or user interaction is required. The flaw is triggered through Lua scripting functionality exposed by the Debian-packaged Redis build.

Exploitation

CVE-2022-0543 is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-03-28) and has an EPSS 30-day probability of 0.99351 (99.9th percentile), with public exploit references tagged 'Exploit'. No ransomware campaign use is documented in the record.

What to do

• Apply the Debian security update (DSA-5081) or the vendor-recommended patched package for Redis immediately.
• If patching cannot be done at once, restrict network access to Redis so it is not reachable from untrusted networks.
• Require authentication and avoid exposing Redis on public interfaces; bind to localhost or trusted management networks only.
• Disable or restrict the Lua scripting interface (EVAL/EVALSHA) where it is not operationally required.
• Monitor vendor advisories for any additional affected packages or downstream products.

Detection

• Monitor Redis logs and process behavior for unexpected EVAL/EVALSHA usage or Lua script execution.
• Alert on Redis spawning child processes or making outbound network connections, which is abnormal for a database service.
• Hunt for known public exploit payloads against Redis Lua scripting in network traffic or host telemetry.
• Track unpatched Debian Redis instances in asset inventory and verify package versions against DSA-5081.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.