Redis CVE-2025-49844: Use-After-Free may lead to remote code execution
1–10 of 15 posts
Re: Redis CVE-2025-49844: Use-After-Free may lead to remote code execution
#2How does it work?
Re: Redis CVE-2025-49844: Use-After-Free may lead to remote code execution
#3most people use redis on localhost (i hope)
Re: Redis CVE-2025-49844: Use-After-Free may lead to remote code execution
#4most people use redis on localhost (i hope)
I’d imagine recent uptick in using services like Upstash may make it harder for people to know if they are vulnerable or not. Is this mitigated by disabling Lua script execution?
Re: Redis CVE-2025-49844: Use-After-Free may lead to remote code execution
#5Note that this requires an authenticated user, so most redis installations are not directly at risk.
The github issue has these workarounds: > An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.
I guess most people doesn't use the lua engine, so this is probably a good advice to disable even if upgrading to a non-vuln version of Redis.
Re: Redis CVE-2025-49844: Use-After-Free may lead to remote code execution
#6This was here already earlier today:
https://news.ycombinator.com/item?id=45497027
Also: "As part of an ongoing effort by Redis and the Redis community to maintain Redis’ safety, security, and compliance posture, a security vulnerability in Redis has been identified and remediated in the versions indicated below." seems to be a bit strange given that this wasn't an effort led by Redis?
Re: Redis CVE-2025-49844: Use-After-Free may lead to remote code execution
#7most people use redis on localhost (i hope)
I’d imagine recent uptick in using services like Upstash may make it harder for people to know if they are vulnerable or not. Is this mitigated by disabling Lua script execution?
I would guess it is.
Also:
> Exploitation of this vulnerability requires an attacker to first gain authenticated access to your Redis instance.
Re: Redis CVE-2025-49844: Use-After-Free may lead to remote code execution
#8And this is why we need memory safety languages.
Re: Redis CVE-2025-49844: Use-After-Free may lead to remote code execution
#9most people use redis on localhost (i hope)
I’d imagine recent uptick in using services like Upstash may make it harder for people to know if they are vulnerable or not. Is this mitigated by disabling Lua script execution?
Upstash wouldn’t be vulnerable - Upstash doesn’t run upstream redis, it’s a protocol-compatible proprietary implementation.
Re: Redis CVE-2025-49844: Use-After-Free may lead to remote code execution
#10Note that this requires an authenticated user, so most redis installations are not directly at risk. The github issue has these workarounds: > An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands. I guess most people doesn't use the lua engine, so this is probably a…
I'd like to see stats about that. Lua scripts in Redis are one of its most useful feature