Critical Redis vulnerability: tens of thousands at risk of remote code execution attacks

Issue tied to Redis's embedded Lua scripting engine

The Redis security team has issued a warning to system administrators and cloud infrastructure providers after discovering a critical vulnerability that could allow threat actors to remotely hijack Redis servers and gain persistent access to sensitive environments.

The flaw in the database, tracked as CVE-2025-49844, has been assigned the highest possible severity rating of CVSS 10.0 due to its potential for remote code execution (RCE).

Redis, which powers approximately 75% of all cloud environments, is widely used as an ultra-fast, in-memory data structure store that functions as a database, cache, and message broker.

At the heart of this newly disclosed vulnerability is a use-after-free bug located within the Redis source code.

The issue is tied to Redis's embedded Lua scripting engine, which is enabled by default and also present in Valkey, an open source fork of Redis.

According to the Redis team, this memory management flaw can be exploited by an authenticated attacker who uploads a specially crafted Lua script to trigger the vulnerability.

If successful, attackers can break out of the Lua sandbox, exploit the dangling memory pointer to establish a reverse shell, and ultimately execute arbitrary code on the host machine.

From there, attackers can steal credentials and sensitive in-memory data; install malware or cryptocurrency miners; move laterally across internal networks; and gain access to other cloud services via exfiltrated tokens or keys.

Although exploitation requires authenticated access, cloud security firm Wiz reported that approximately 330,000 Redis instances are currently exposed online, with at least 60,000 accessible without any authentication controls in place.

Researchers Benny Isaacs, Nir Brakha, and Sagi Tzadik from Wiz discovered the flaw in collaboration with Trend Micro's Zero Day Initiative.

Patches released

Both Redis and Valkey released patches on Friday, 3rd October, addressing the flaw in all affected versions.

They urge all Redis users, especially those running internet-facing instances, to apply the updates immediately.

"This issue is due to a problem in Lua and how it handles memory - an attacker could potentially get access to memory that had previously been used, and then use that to run code," explained Martin Visser, Valkey lead at Percona.

"This is a serious issue, but one that the community has responded to quickly."

For administrators who are not immediately ready to patch, Visser recommends removing Lua script execution privileges through ACL (Access Control List) rules and ensuring authentication and authorisation are properly configured.

In addition to patching, Redis and Wiz recommend the following security hardening steps:

• Enable authentication and restrict access with strong credentials
• Disable Lua scripting if not in use
• Run Redis as a non-root user
• Limit access to trusted IP addresses and networks only
• Implement firewalls and Virtual Private Clouds (VPCs)
• Monitor logs and enable alerts for unusual behaviour

Redis instances have become increasingly popular targets for cryptojacking and malware botnets. In June 2024, the P2PInfect malware spread across Redis servers to deploy Monero miners and even ransomware modules.

Prior campaigns have used malware families like Redigo, HeadCrab and Migo to disable Redis security features and exploit exposed servers for cryptocurrency mining.

With CVE-2025-49844, experts fear a fresh wave of Redis-targeted attacks leveraging this new exploit.