CVE-2025-49844
Executive Summary
CVE-2025-49844 is a critical use-after-free vulnerability in Redis, an open-source in-memory database, affecting all versions with Lua scripting support up to and including 8.2.1. An authenticated attacker can execute a specially crafted Lua script that manipulates the garbage collector, leading to a use-after-free condition that can potentially be leveraged for remote code execution (RCE). The vulnerability has a CVSS score of 10.0, indicating maximum severity. A public proof-of-concept (PoC) and a Nuclei template are available, confirming active exploitation risk. The official fix is included in Redis version 8.2.2. As a workaround, administrators can restrict Lua script execution via ACL controls on the EVAL and EVALSHA commands.
This record — and 170,000+ others — are available via the ValtersIT API. One endpoint replaces five: NVD + GitHub CVE + CISA KEV + EPSS + Nuclei + Exploit-DB, unified.
No signup required
Supply Chain & Package Security
Redis is a widely used component in many software supply chains, often deployed as a database, cache, or message broker. This vulnerability poses a significant supply chain risk because:
- Widespread Adoption: Redis is embedded in numerous applications, cloud services, and containerized environments.
- Authenticated Access Required: While authentication is required, default or weak credentials are common in internal networks, making exploitation feasible.
- Lua Scripting Dependency: Many legitimate applications rely on Lua scripting, making it difficult to disable without breaking functionality.
- No Official Package Patch: The official fix is only available in the source code repository (version 8.2.2). Package managers (e.g., npm, PyPI, Go modules) may not have immediate updates, leaving downstream users exposed.
CVSS Breakdown & Threat Level
- CVSS Score: 10.0 (Critical)
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Attack Vector (AV): Network (N) - Exploitable remotely.
- Attack Complexity (AC): Low (L) - No special conditions required.
- Privileges Required (PR): Low (L) - Requires authenticated access to Redis.
- User Interaction (UI): None (N) - No user action needed.
- Scope (S): Unchanged (U) - Vulnerability does not affect other components.
- Confidentiality (C): High (H) - Full data disclosure possible.
- Integrity (I): High (H) - Full data modification possible.
- Availability (A): High (H) - Full denial of service possible.
Threat Level: Critical. The combination of network exploitability, low complexity, and potential for RCE makes this a top-priority vulnerability for patching.
Deep Dive & Mechanics
The vulnerability resides in Redis's Lua scripting engine. When a Lua script is executed via EVAL or EVALSHA, Redis internally manages Lua objects and references. A use-after-free occurs when an attacker crafts a Lua script that:
- Creates a Lua object (e.g., a table or function).
- Forces the Lua garbage collector to run and free that object.
- Subsequently accesses the freed memory through a dangling pointer.
This can be achieved by exploiting the interaction between Redis's custom Lua bindings and the standard Lua garbage collector. The attacker can manipulate the garbage collector's behavior by:
- Creating circular references that are not properly tracked.
- Using
collectgarbage()to trigger collection at specific times. - Exploiting race conditions between Redis's reference counting and Lua's garbage collection.
Once a use-after-free is triggered, the attacker can overwrite the freed memory with controlled data, leading to arbitrary code execution within the Redis process context.
Vulnerable vs. Patched Code
Vulnerable Code (Redis < 8.2.2):
The vulnerable code likely involves improper handling of Lua object references in the Redis C source. For example, in src/scripting.c or similar files, a reference to a Lua object might be stored in a Redis data structure (e.g., a key-value pair) without properly incrementing the Lua reference count. When the Lua garbage collector runs, it frees the object, but the Redis pointer remains, leading to a use-after-free.
// Hypothetical vulnerable code snippet
lua_State *lua = server.lua;
lua_getglobal(lua, "my_table");
// Store reference without incrementing refcount
redisObject *obj = createObject(OBJ_STRING, lua_tostring(lua, -1));
// Later, Lua GC frees the table
// obj->ptr now points to freed memory
Patched Code (Redis >= 8.2.2):
The patch likely ensures that all Lua object references are properly tracked using lua_ref() and lua_unref() or by copying the data immediately. The fix may also involve disabling certain garbage collector interactions or adding validation checks.
// Hypothetical patched code snippet
lua_State *lua = server.lua;
lua_getglobal(lua, "my_table");
// Copy the string immediately to avoid dangling reference
const char *str = lua_tostring(lua, -1);
redisObject *obj = createStringObject(str, strlen(str));
lua_pop(lua, 1);
Exploitation & Lab Setup
Red Team (Exploitation)
Prerequisites:
- Access to a Redis server (version < 8.2.2) with Lua scripting enabled.
- Valid credentials (or no authentication if ACLs are not configured).
Exploit Steps:
- Connect to Redis: Use
redis-clior a custom script to connect. - Craft Lua Script: Create a Lua script that triggers the use-after-free. The exact payload is not publicly disclosed, but it involves manipulating the garbage collector.
- Execute Script: Use
EVALto run the malicious script. - Trigger RCE: The use-after-free allows overwriting function pointers or other critical data, leading to code execution.
Example (Conceptual):
redis-cli -h target -p 6379 -a password
EVAL "
-- Crafted Lua script to trigger UAF
local t = {}
setmetatable(t, {__gc = function() end})
t = nil
collectgarbage()
-- Now access freed memory
return t.somefield
" 0
Nuclei Template Usage: The provided Nuclei template can be used to scan for vulnerable Redis instances. It first checks the Redis version, then attempts to execute a simple Lua script to confirm Lua is enabled.
nuclei -t CVE-2025-49844.yaml -u redis://target:6379
Blue Team (Detection & Hardening)
Detection:
- Monitor Redis logs for unusual Lua script execution patterns.
- Use the provided YARA and Sigma rules to detect exploitation attempts.
- Deploy Suricata rules to inspect network traffic for malicious Lua payloads.
Hardening:
- Immediate: Upgrade to Redis 8.2.2 or later.
- Workaround: Restrict Lua script execution using ACLs:
Or specifically denyACL SETUSER default -@scriptingEVALandEVALSHA:ACL SETUSER default -EVAL -EVALSHA - Network Segmentation: Ensure Redis is not exposed to untrusted networks.
- Authentication: Enforce strong passwords and use TLS for connections.
Indicators of Compromise (IOCs)
- Network:
- Unusual Lua script payloads in Redis traffic (e.g., containing
collectgarbage,__gc, or complex metatable manipulations). - Connections from IPs attempting to execute
EVALwith large or obfuscated scripts.
- Unusual Lua script payloads in Redis traffic (e.g., containing
- Host:
- Redis process crashes or segmentation faults.
- Unexpected child processes spawned by Redis.
- Modified Redis configuration files.
- Logs:
- Redis log entries showing repeated Lua script execution errors.
- ACL denial logs for
EVAL/EVALSHAcommands.
- File System:
- Suspicious files in the Redis working directory (e.g.,
.sofiles for code execution).
- Suspicious files in the Redis working directory (e.g.,
Detection Engineering
YARA Rule
rule CVE_2025_49844_Redis_Lua_UAF {
meta:
description = "Detects Lua scripts attempting to exploit CVE-2025-49844 use-after-free in Redis"
author = "Valters IT"
date = "2025-04-10"
reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-49844"
severity = "critical"
strings:
$s1 = "collectgarbage" ascii wide nocase
$s2 = "__gc" ascii wide nocase
$s3 = "setmetatable" ascii wide nocase
$s4 = "EVAL" ascii wide nocase
$s5 = "EVALSHA" ascii wide nocase
condition:
(uint16(0) == 0x4C75 or uint16(0) == 0x6C75) and // Lua script magic bytes
(all of ($s1, $s2, $s3) or ($s4 or $s5))
}
Sigma Rule
title: Redis Lua Script Exploitation Attempt (CVE-2025-49844)
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit use-after-free in Redis Lua scripting engine
author: Valters IT
date: 2025-04-10
references:
- https://nvd.nist.gov/vuln/detail/CVE-2025-49844
logsource:
category: application
product: redis
detection:
selection:
EventID: 1000 # Redis command execution log
Command:
- 'EVAL'
- 'EVALSHA'
ScriptContent|contains:
- 'collectgarbage'
- '__gc'
- 'setmetatable'
condition: selection
falsepositives:
- Legitimate use of Lua garbage collection in custom scripts
level: critical
Suricata Rule
alert tcp $EXTERNAL_NET any -> $HOME_NET 6379 (msg:"CVE-2025-49844 Redis Lua Use-After-Free Exploit Attempt"; flow:to_server,established; content:"EVAL"; nocase; content:"collectgarbage"; distance:0; within:100; content:"__gc"; distance:0; within:100; classtype:attempted-admin; sid:1000001; rev:1;)
Nuclei Template (Provided)
id: CVE-2025-49844
info:
name: Redis Lua Parser < 8.2.2 - Use After Free
author: pussycat0x
severity: critical
description: |
Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.
impact: |
Authenticated attackers can manipulate the garbage collector through crafted Lua scripts to trigger use-after-free conditions, potentially achieving remote code execution on Redis servers.
remediation: |
Upgrade to version 8.2.2 or later.
reference:
- https://www.wiz.io/blog/wiz-research-redis-rce-cve-2025-49844
- https://github.com/dwisiswant0/CVE-2025-49844
metadata:
verified: true
max-request: 1
shodan-query: product:"redis"
tags: cve,cve2025,js,redis,network,passive,authenticated,vuln,vkev
flow: javascript(1) && javascript(2)
javascript:
- pre-condition: |
isPortOpen(Host,Port);
code: |
const redis = require('nuclei/redis');
const info = redis.GetServerInfo(Host,Port);
Export(info);
args:
Host: "{{Host}}"
Port: "6379"
matchers:
- type: dsl
dsl:
- success == true
- compare_versions(version, ' < 8.2.2')
condition: and
extractors:
- type: regex
name: version
part: response
group: 1
regex:
- redis_version:(\d+\.\d+\.\d+)
- code: |
const redis = require('nuclei/redis');
const info = redis.RunLuaScript(Host,Port,Password,Payload);
Export(info);
args:
Host: "{{Host}}"
Port: "6379"
Password: "{{passwords}}"
Payload: 'return "lua enabled"'
payloads:
passwords:
- ""
matchers:
- type: dsl
dsl:
- success == true
- contains(response, 'lua enabled')
condition: and
internal: true
# digest: 490a00463044022008ea7302c983f927b3414adbb7be9b9a84a18be037398ed0707e72325bedc756022063ad083f9a939166ebe829b36a1a924c1ff76301219de4bbb15daf933ac61210:922c64590222798bb761d5b6d8e72950
Remediation & Mitigation
Immediate Actions:
- Patch: Upgrade all Redis instances to version 8.2.2 or later.
- Workaround: If patching is not immediately possible, restrict Lua script execution using ACLs:
Or specifically denyACL SETUSER default -@scriptingEVALandEVALSHA:ACL SETUSER default -EVAL -EVALSHA - Network Controls: Ensure Redis is not exposed to the internet. Use firewalls to restrict access to trusted IPs only.
- Authentication: Enforce strong, unique passwords for all Redis users. Disable the default
defaultuser if not needed.
Long-Term Measures:
- Implement a vulnerability management program to ensure timely patching.
- Monitor for new CVEs affecting Redis and other critical infrastructure.
- Use runtime security tools (e.g., Falco, Sysdig) to detect anomalous Redis behavior.
- Conduct regular security audits and penetration testing.
Valters IT
DevSecOps & Cyber Threat Intelligence Division
{/* [Security Hash: 7C165A7E2E6A55683F81F0B0] */}