CVE-2025-49844: Valkey · Redis Lua Use-After-Free may lead to remote code execution
Affects valkeySource GCVE Database
Not known to be exploited · public detection template (Nuclei) · 82% EPSS · fixed in 8.1.4 : patch valkey as a priority.
Data as of 26 Oct 2026, 08:30 UTC
Likely to be exploited
82.6% EPSS · Critical severity · No CVSS score from NVD or the CNA
- EPSS
- 82.6% chance of exploitation in 30 days – higher than 99% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 8.1.4, 8.0.6, 7.2.11
Exploitation evidence
Disclosed: evidence found.
CVE published 16 Oct 2025
Detectable: evidence found.
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade valkey to 8.1.4, 8.0.6 or 7.2.11.
Patches and advisories
Affected software
| Product | Affected | Fixed in |
|---|---|---|
Bitnamivalkeypkg:bitnami/valkeyOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
A patch is available and the issue is fixed in Redis version 8.2.2. Users should upgrade to this version to fully remediate the vulnerability. As a temporary workaround, administrators can prevent execution of Lua scripts by restricting the EVAL and EVALSHA commands using Redis ACLs. This limits the attack surface until patching is performed.
Description
Redis versions 7.2.10 and earlier, 8.0.0 through 8.0.5, and 8.1.0 through 8.1.3 contain a use-after-free vulnerability in the Lua scripting engine. An authenticated user can exploit this by submitting a crafted Lua script that manipulates the garbage collector, potentially leading to remote code execution. This vulnerability is fixed in Redis version 8.2.2. As a workaround, administrators can restrict Lua script execution using ACLs to disable EVAL and EVALSHA commands.
References
- github.com/redis/redis/commit/d5728cb5795c966c5b5b1e0f0ac576a7e69af539 (opens in a new tab)
- github.com/redis/redis/releases/tag/8.2.2 (opens in a new tab)
- github.com/redis/redis/security/advisories/GHSA-4789-qfc9-5f9q (opens in a new tab)
- nvd.nist.gov/vuln/detail/CVE-2025-49844 (opens in a new tab)
- openwall.com/lists/oss-security/2025/10/07/2 (opens in a new tab)
- github.com/lastvocher/redis-CVE-2025-49844 (opens in a new tab)