Search: CVE-2025-49844

Redis versions 7.2.10 and earlier, 8.0.0 through 8.0.5, and 8.1.0 through 8.1.3 contain a use-after-free vulnerability in the Lua scripting engine. An authenticated user can exploit this by submitting a crafted Lua script that manipulates the garbage collector, potentially leading to remote code execution. This vulnerability is fixed in Redis version 8.2.2. As a workaround, administrators can restrict Lua script execution using ACLs to disable EVAL and EVALSHA commands.