CVE-2025-49844 Redis Lua Use-After-Free may lead to remote code execution

What is CVE-2025-49844?

CVE-2025-49844 is a critical use after free vulnerability in redis, published on 3 Oct 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.

Weakness: CWE-416

Which versions are affected by CVE-2025-49844?

3 open source packages ship an affected version, including redis, keydb and valkey. It affects 2 products.

Products include Lfprojects Valkey, Redis Redis.

How do I fix CVE-2025-49844?

Upgrade redis to a fixed version for your release line: 6.2.20, 7.2.11, 7.4.6 or 8.0.4.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2025-49844 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-49844 exists.

Public exploit code: 1 Nuclei template and 19 proofs of concept on GitHub.

Other vulnerabilities in redis

• CVE-2025-67733 Valkey Affected by RESP Protocol Injection via Lua error_reply High 8.5
• CVE-2026-21863 Malformed Valkey Cluster bus message can lead to Remote DoS High 7.5
• CVE-2026-27623 Valkey has Pre-Authentication DOS from malformed RESP request High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2025-49844, AZL-68226, AZL-68352, AZL-68363, AZL-68426, BELL-CVE-2025-49844 and 18 more.