CVE-2015-4335

Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua bytecode via the eval command.

• CWE-17

• http://benmmurphy.github.io/blog/2015/06/04/redis-eval-lua-sandbox-escape/Exploit, Third Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162094.htmlThird Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162146.htmlThird Party Advisory
• http://lists.opensuse.org/opensuse-updates/2015-10/msg00014.htmlThird Party Advisory
• http://rhn.redhat.com/errata/RHSA-2015-1676.htmlThird Party Advisory
• http://www.debian.org/security/2015/dsa-3279Third Party Advisory
• http://www.openwall.com/lists/oss-security/2015/06/04/12Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2015/06/04/8Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2015/06/05/3Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/75034Third Party Advisory, VDB Entry
• https://github.com/antirez/redis/commit/fdf9d455098f54f7666c702ae464e6ea21e25411Third Party Advisory
• https://groups.google.com/forum/#%21msg/redis-db/4Y6OqK8gEyk/Dg-5cejl-eUJ
• https://security.gentoo.org/glsa/201702-16Third Party Advisory
• http://benmmurphy.github.io/blog/2015/06/04/redis-eval-lua-sandbox-escape/Exploit, Third Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162094.htmlThird Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162146.htmlThird Party Advisory
• http://lists.opensuse.org/opensuse-updates/2015-10/msg00014.htmlThird Party Advisory
• http://rhn.redhat.com/errata/RHSA-2015-1676.htmlThird Party Advisory
• http://www.debian.org/security/2015/dsa-3279Third Party Advisory
• http://www.openwall.com/lists/oss-security/2015/06/04/12Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2015/06/04/8Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2015/06/05/3Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/75034Third Party Advisory, VDB Entry
• https://github.com/antirez/redis/commit/fdf9d455098f54f7666c702ae464e6ea21e25411Third Party Advisory
• https://groups.google.com/forum/#%21msg/redis-db/4Y6OqK8gEyk/Dg-5cejl-eUJ
• https://security.gentoo.org/glsa/201702-16Third Party Advisory

Published

Jun 9, 2015

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-4328Cisco TelePresence Video Communication Server (VCS) Expressw…
• CVE-2015-4329The administrator web interface in Cisco TelePresence Video …
• CVE-2015-4330A local file script in Cisco TelePresence Video Communicatio…
• CVE-2015-4331Cisco Prime Infrastructure (PI) 1.4(0.45) and earlier, when …
• CVE-2015-4332Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2015-4334The default configuration of SGOS in Blue Coat ProxySG befor…
• CVE-2015-4336cloner.functions.php in the XCloner plugin 3.1.2 for WordPre…
• CVE-2015-4337Cross-site scripting (XSS) vulnerability in the XCloner plug…
• CVE-2015-4338Static code injection vulnerability in the XCloner plugin 3.…
• CVE-2015-4342SQL injection vulnerability in Cacti before 0.8.8d allows re…
• CVE-2015-4344The Services Basic Authentication module 7.x-1.x through 7.x…
• CVE-2015-4345The RESTWS Basic Auth submodule in the RESTful Web Services …