13-Year-Old Redis Flaw Exposed: CVSS 10.0 Vulnerability Lets Attackers Run Code Remotely

Summary: Redis disclosed CVE-2025-49844, a CVSS 10.0 use-after-free flaw in its Lua scripting that lets an authenticated user run a crafted script to escape the Lua sandbox and execute code on the host, affecting all versions of Redis. Wiz, which reported the bug to Redis on May 16, 2025, said it has existed in the source code for about 13 years, and fixes shipped October 3, 2025 in versions 6.2.20, 7.2.11, 7.4.6, 8.0.4, and 8.2.2.
Why it matters: About 330,000 Redis instances are exposed to the internet and roughly 60,000 of them have no authentication at all, so the authenticated-access precondition is already met for a large share of deployments.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2025-49844
Related: ⚡ Weekly Recap: Oracle 0-Day, Bit Locker Bypass, VMScape, WhatsApp Worm & More Cyber Risks ·
⚡ Weekly Recap: WhatsApp Worm, Critical CVEs, Oracle 0-Day, Ransomware Cartel & More Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026