CVE-2025-49844

Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.

• CWE-416

• https://github.com/redis/redis/commit/d5728cb5795c966c5b5b1e0f0ac576a7e69af539Patch
• https://github.com/redis/redis/releases/tag/8.2.2Release Notes
• https://github.com/redis/redis/security/advisories/GHSA-4789-qfc9-5f9qThird Party Advisory
• http://www.openwall.com/lists/oss-security/2025/10/07/2Mailing List, Third Party Advisory
• https://github.com/lastvocher/redis-CVE-2025-49844

Published

Oct 3, 2025

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-49839GPT-SoVITS-WebUI is a voice conversion and text-to-speech we…9.8
• CVE-2025-4984A stored Cross-site Scripting (XSS) vulnerability affecting …8.7
• CVE-2025-49840GPT-SoVITS-WebUI is a voice conversion and text-to-speech we…9.8
• CVE-2025-49841GPT-SoVITS-WebUI is a voice conversion and text-to-speech we…9.8
• CVE-2025-49842conda-forge-webservices is the web app deployed to run conda…1
• CVE-2025-49843conda-smithy is a tool for combining a conda recipe with con…2.7
• CVE-2025-49845Discourse is an open-source discussion platform. The visibil…7.5
• CVE-2025-49846wire-ios is an iOS client for the Wire secure messaging appl…4.1
• CVE-2025-49847llama.cpp is an inference of several LLM models in C/C++. Pr…8.8
• CVE-2025-49848An out-of-bounds write vulnerability exists within the parsi…8.4
• CVE-2025-49849An Out-of-bounds Read vulnerability exists within the parsin…8.4
• CVE-2025-4985A stored Cross-site Scripting (XSS) vulnerability affecting …8.7