Wiz Research has uncovered a critical remote code execution vulnerability in Redis, identified as CVE-2025-49844 or ‘RediShell.’ This vulnerability, with a CVSS score of 10.0, emerges from a 13-year-old use-after-free bug found in the Lua interpreter utilized within Redis. It allows authenticated attackers to bypass the Lua sandbox and execute arbitrary code on the host system.
This flaw has widespread implications as Redis is a dominant in-memory data store deployed in approximately 75% of cloud environments. Alarmingly, around 330,000 Redis instances are exposed to the internet, with about 60,000 lacking authentication mechanisms, increasing their susceptibility to attacks.
Redis and its fork Valkey have promptly released patches to address this issue in versions 6.2.20, 7.2.11, 7.4.6, 8.0.4, and 8.2.2 for Redis. The recommended actions for organizations include immediately upgrading to these patched versions, enabling authentication, restricting network access, and disabling unnecessary Lua scripting commands. Additionally, users should employ Access Control Lists (ACLs) to limit Lua script execution and ensure that Redis instances are not publicly accessible.
Given the severity and the potential impact, organizations using Redis, especially those with internet-facing instances, are urged to take these mitigation steps without delay to protect their systems and data.

Collections

Wiz Research discovered RediShell (CVE-2025-49844), a critical remote code execution vulnerability in Redis with a maximum CVSS score of 10.0. The flaw stems from a 13-year-old use-after-free bug in Redis's Lua interpreter that allows authenticated attackers to bypass the sandbox and execute arbitrary code. With Redis deployed in 75% of cloud environments and 330,000 instances exposed online (60,000 without authentication), the impact is severe. Patches are available for Redis versions 6.2.20, 7.2.11, 7.4.6, 8.0.4, and 8.2.2, along with Valkey. Organizations should immediately upgrade, enable authentication, restrict network access, disable unnecessary Lua commands, and implement ACLs to limit script execution.

Critical Redis Vulnerability CVE‑2025‑49844: Immediate Action Required

a 10.0 for this is ridiculous. what are CVE ratings even