CVE-2025-49844

The vulnerability in the Redis in-memory database, particularly in versions up to 8.2.1, stems from a flaw in the handling of Lua scripts, which are used for executing custom commands within the database environment. This issue arises when an authenticated user is able to craft a specific Lua script that manipulates the garbage collector. Such manipulation can lead to a use-after-free condition, a type of memory corruption that can be exploited to execute arbitrary code remotely. The underlying problem is rooted in the interaction between the Lua scripting engine and Redis's memory management, which fails to adequately sanitize or validate the operations being performed on memory, allowing malicious scripts to disrupt normal operations.

Attack vectors for this vulnerability are particularly concerning due to the ease with which an authenticated user can exploit it. Once a user gains access to the Redis instance, they can execute Lua scripts using the EVAL or EVALSHA commands. By crafting a malicious script that triggers the use-after-free condition, an attacker can gain control over the execution flow of the Redis server. This could lead to unauthorized access to sensitive data, manipulation of stored information, or even complete system compromise. The potential for remote code execution makes this vulnerability especially dangerous, as it allows attackers to run arbitrary commands on the server hosting the Redis instance, potentially leading to further exploitation of the underlying infrastructure.

In terms of real-world impact, the risks associated with this vulnerability are significant for businesses that rely on Redis for data storage and caching. The high CVSS score of 9.9 indicates critical severity, suggesting that successful exploitation could lead to severe consequences, including data breaches, loss of data integrity, and disruption of services. Organizations that utilize Redis in their architecture must consider the implications of this vulnerability on their operational security posture. The potential for data loss or unauthorized access can lead to reputational damage, regulatory penalties, and financial losses, particularly in sectors that handle sensitive information, such as finance, healthcare, and e-commerce.

To effectively detect and mitigate this vulnerability, organizations should implement a multi-layered security approach. First and foremost, upgrading to version 8.2.2 or later is essential, as this version includes patches that address the identified weaknesses. In environments where immediate patching is not feasible, administrators can employ access control lists (ACLs) to restrict the execution of Lua scripts by disabling the EVAL and EVALSHA commands for untrusted users. Regular monitoring of Redis logs for unusual script execution patterns can also aid in early detection of potential exploitation attempts. Additionally, employing network segmentation and firewall rules to limit access to Redis instances can further reduce the attack surface.

In conclusion, the vulnerability present in Redis versions up to 8.2.1 poses a serious threat to organizations leveraging this popular in-memory database. The combination of ease of exploitation and the potential for severe consequences necessitates immediate attention from security teams. By understanding the technical details, recognizing the attack vectors, assessing the real-world impact, and implementing robust detection and mitigation strategies, organizations can better protect their assets against this critical vulnerability.

CSURFACE threat intelligence has detected a marked escalation in activity related to CVE-2025-49844, with telemetry indicating a significant uptick in exploitation attempts targeting vulnerable Redis instances. This increase is accompanied by a measurable rise in the Exploit Prediction Scoring System (EPSS) score, reflecting growing confidence in the exploitability of this vulnerability. Concurrently, multiple new proof-of-concept exploits have emerged on public repositories, expanding the available toolkit for adversaries and lowering the barrier to entry for exploitation. This development signals heightened attacker interest and operationalization, increasing the likelihood of widespread compromise. For defenders, this trend underscores the urgency of monitoring for exploitation indicators and reassessing risk postures, as the expanding exploit landscape and rising telemetry suggest a transition from theoretical risk to active threat. Consequently, the threat level associated with CVE-2025-49844 has escalated from high to critical, demanding immediate attention within security operations to detect and respond to exploitation attempts.

Update 2 — May 16, 2026

CSURFACE threat intelligence has detected a marked escalation in exploitation attempts targeting CVE-2025-49844, reflected by a substantial increase in Lua script-based attack activity within Redis environments. Although the EPSS score has declined, indicating a slight reduction in predicted exploit probability, our telemetry reveals a contrasting surge in operational exploitation, underscoring active adversary engagement. The proliferation of new proof-of-concept exploits, including those enabling persistent backdoor access, signals that threat actors are rapidly refining and weaponizing this vulnerability. This divergence between predictive scoring and real-world exploitation highlights the necessity for defenders to prioritize detection and response capabilities despite ostensibly lower risk forecasts. Consequently, the threat level associated with CVE-2025-49844 remains elevated at critical, as the expanding exploit toolkit and increased attack frequency amplify the potential for widespread compromise across Redis deployments.