13-Year-Old Redis Flaw Exposed: CVSS 10.0 Vulnerability Lets Attackers Run Code Remotely
Redis has revealed information about a maximum-severity security vulnerability in its in-memory database software that, in some cases, might lead to remote code execution.
The vulnerability, known as RediShell and tagged as CVE-2025-49844, has a CVSS score of 10.0.
A GitHub alert for the vulnerability states that a specially designed Lua script might be used by an authenticated user to control the garbage collector, cause a use-after-free, and possibly result in remote code execution. The issue is present in all Redis versions that use Lua scripting.
However, in order for exploitation to succeed, an attacker must first obtain authenticated access to a Redis instance. For this reason, it is essential that users secure their Redis instances with robust authentication and avoid leav...