CVE-2025-49844

Katalog CVE

CVSS 9.9 · Critical EPSS 82,3%

Kerentanan Use After Free pada redis, lfprojects valkey. Skor CVSS 3.1 9.9 (Critical) menurut NVD.

Deskripsi (NVD)

Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.

Rincian

Terbit di NVD

3 Oktober 2025

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.9 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-416: Use After Free

EPSS (30 hari)

82,3% peluang dieksploitasi; lebih tinggi dari 99,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/redis/redis/commit/d5728cb5795c966c5b5b1e0f0ac576a7e69af539 patch
• https://github.com/redis/redis/security/advisories/GHSA-4789-qfc9-5f9q advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2025/10/07/2 mailing list · advisory pihak ketiga
• https://github.com/redis/redis/releases/tag/8.2.2 release notes
• https://github.com/lastvocher/redis-CVE-2025-49844