Skip to content
OpenAdvisories
High ALSA-2025:20926 4 CVEs

Important: redis security update

Published Nov 11, 2025 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, or by appending each command to a log.

Security Fix(es):

* redis: Lua library commands may lead to integer overflow and potential RCE (CVE-2025-46817)
* Redis: Redis: Authenticated users can execute LUA scripts as a different user (CVE-2025-46818)
* Redis: Redis is vulnerable to DoS via specially crafted LUA scripts (CVE-2025-46819)
* Redis: Redis Lua Use-After-Free may lead to remote code execution (CVE-2025-49844)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 3

ReleasePackageFixed in
AlmaLinux · 9 redis 6.2.20-2.el9_7
AlmaLinux · 9 redis-devel 6.2.20-2.el9_7
AlmaLinux · 9 redis-doc 6.2.20-2.el9_7

Vulnerabilities 4

  • Critical 10.0
    CVE-2025-49844 Public exploit Scanner template EPSS 83%

    Redis Lua Use-After-Free may lead to remote code execution

    Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code exe…

    Redis Redis redis redis Debian Ubuntu Azure Linux Alpine
  • High 7.0
    CVE-2025-46817 Public exploit Scanner template

    Lua library commands may lead to integer overflow and potential RCE

    Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to cause an integer overflow and potentially lead to remote code execution The problem exists in all …

    Redis Redis redis redis Debian Ubuntu Azure Linux Alpine
  • Medium 6.3
    CVE-2025-46819 Public exploit Scanner template

    Redis is vulnerable to DoS via specially crafted LUA scripts

    Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted LUA script to read out-of-bound data or crash the server and subsequent denial of service. The problem exists in…

    Redis Redis redis redis Debian Ubuntu Azure Linux Alpine
  • Medium 6.0
    CVE-2025-46818 Public exploit Scanner template

    Redis: Authenticated users can execute LUA scripts as a different user

    Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate different LUA objects and potentially run their own code in the context of another user…

    Redis Redis redis redis Debian Ubuntu Azure Linux Alpine

References

  • report
    https://access.redhat.com/security/cve/CVE-2025-46817
  • report
    https://access.redhat.com/security/cve/CVE-2025-46818
  • report
    https://access.redhat.com/security/cve/CVE-2025-46819
  • report
    https://access.redhat.com/security/cve/CVE-2025-49844
  • report
    https://bugzilla.redhat.com/2401258
  • report
    https://bugzilla.redhat.com/2401292
  • report
    https://bugzilla.redhat.com/2401322
  • report
    https://bugzilla.redhat.com/2401324
  • advisory
    https://errata.almalinux.org/9/ALSA-2025-20926.html