Vulnerability

CERT-In Vulnerability Note CIVN-2025-0246
Remote Code Execution Vulnerability in Redis (RediShell)

Original Issue Date:October 07, 2025

Severity Rating: CRITICAL

Software Affected

Redis version 8.2.1 and prior

Overview

A vulnerability has been reported in Redis which could allow a remote attacker to execute arbitrary code on the targeted system.

Target Audience:
Individuals and end-user organizations using affected Redis.

Risk Assessment:
High risk of sensitive data disclosure and system compromise.

Impact Assessment:
Potential for remote code execution and system compromise.

Description

Redis is an open-source, in-memory data structure store used as a high-performance database, cache, and message broker for applications needing rapid data access and processing.

This vulnerability exists in Redis due to a use-after-free memory corruption issue. A remote attacker could exploit this vulnerability by sending a specially crafted Lua script that manipulate the garbage collector and potentially lead to remote code execution.

Successful exploitation of this vulnerability could allow an attacker to gain authenticated access to Redis instance.

Solution

Apply appropriate software updates as mentioned by the vendor:
https://redis.io/blog/security-advisory-cve-2025-49844/

Vendor Information

Redis
https://redis.io/blog/security-advisory-cve-2025-49844/

References

Redis
https://redis.io/blog/security-advisory-cve-2025-49844/

CVE Name
CVE-2025-49844

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-22902657

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India