Critical · published October 4, 2025
CVSS calls it critical at 9.9. It sits in the 99.7th percentile for exploit probability.
🚨 An authenticated user could unleash chaos with a specially crafted Lua script in Redis! This crafty trick can manipulate the garbage collector and even lead to remote code execution. 🔥 Think of your Redis server as a high-tech kitchen where chefs (users) can whip up gourmet meals (commands) with special recipes (Lua scripts). If one chef learns a sneaky trick to tamper with the kitchen equipment (the garbage collector), they could create a disaster that spills out into the dining room (your system). An attacker with authenticated access could exploit this vulnerability to execute malicious code on your server, potentially gaining control over your entire Redis instance. This could lead to unauthorized access to sensitive data, manipulation of data, or complete server takeover — an absolutely devastating scenario!
Think of your Redis server as a high-tech kitchen where chefs (users) can whip up gourmet meals (commands) with special recipes (Lua scripts). If one chef learns a sneaky trick to tamper with the kitchen equipment (the garbage collector), they could create a disaster that spills out into the dining room (your system). This vulnerability exists because Redis allows authenticated users to execute Lua scripts that can manipulate the garbage collector, leading to a use-after-free condition. This can result in remote code execution, especially in versions 8.2.1 and below.
An attacker with authenticated access could exploit this vulnerability to execute malicious code on your server, potentially gaining control over your entire Redis instance. This could lead to unauthorized access to sensitive data, manipulation of data, or complete server takeover — an absolutely devastating scenario! To mitigate this risk, upgrade Redis to version 8.2.2 immediately. In the meantime, you can prevent Lua script execution by using Access Control Lists (ACL) to restrict the EVAL and EVALSHA commands, which will help protect your environment until you apply the patch. You've got this! With these steps, you'll shore up your Redis security in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| redis/redis | < 6.2.20 | 6.2.20 |
| redis/redis | ≥ 7.0, < 7.2.11 | 7.2.11 |
| redis/redis | ≥ 7.4.0, < 7.4.6 | 7.4.6 |
| redis/redis | ≥ 8.0.0, < 8.0.4 | 8.0.4 |
| redis/redis | ≥ 8.2.0, < 8.2.2 | 8.2.2 |
| lfprojects/valkey | < 7.2.11 | 7.2.11 |
| lfprojects/valkey | ≥ 8.0.0, < 8.0.6 | 8.0.6 |
| lfprojects/valkey | ≥ 8.1.0, < 8.1.4 | 8.1.4 |