CVE-2025-49844: Redis Lua scripting use-after-free enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.9 with network reachability, low privileges, scope change, and high EPSS make this a top remediation priority despite no KEV listing.

What it is

Redis versions 8.2.1 and below contain a use-after-free in the Lua scripting engine. An authenticated user can supply a crafted Lua script that manipulates the garbage collector to trigger the flaw, potentially achieving remote code execution. The issue affects all Redis versions with Lua scripting and is fixed in 8.2.2.

Impact

An attacker with valid credentials can corrupt memory and potentially execute arbitrary code in the context of the redis-server process. This can lead to full compromise of the Redis instance and any data or host access it holds.

Attack surface

Reachable over the network via the Redis protocol by an authenticated user who can run EVAL or EVALSHA; no user interaction is required. The CVSS vector confirms network access, low privileges, and no UI.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.82294, 99.6th percentile), indicating elevated likelihood of exploitation. A public GitHub repository referencing the CVE exists, though no exploit tags are present in the references.

What to do

• Upgrade redis-server to version 8.2.2 or later.
• If patching is not immediately possible, use ACLs to restrict EVAL and EVALSHA commands for all non-administrative users.
• Disable or remove Lua scripting entirely where it is not required.
• Restrict network access to Redis instances to trusted hosts and require strong authentication.
• Monitor for and rotate any credentials that may have been exposed to untrusted users.

Detection

• Audit Redis ACLs and command usage to identify accounts with EVAL or EVALSHA permissions.
• Monitor Redis logs and slowlog for unusual or repeated Lua script executions.
• Watch for unexpected process behavior or outbound connections from redis-server hosts.
• Track Redis version inventory to confirm 8.2.2+ is deployed.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.