Skip to content
OpenAdvisories
High ELSA-2025-20955 4 CVEs

Important: redis:7 security update (Oracle Linux 9)

Published Nov 25, 2025 · Updated Nov 25, 2025

Ecosystem: Oracle Linux

Summary

[7.2.11-1.0.1]
- Build with 64k pages to support redis on UEK on aarch64

[7.2.11-1]
- rebase to 7.2.11 for CVE-2025-49844 CVE-2025-46817 CVE-2025-46818 CVE-2025-46819

[7.2.10-1]
- rebase to 7.2.10 for CVE-2025-27151 CVE-2025-32023 and CVE-2025-48367

[7.2.8-1]
- rebase to 7.2.8 for CVE-2025-21605

[7.2.7-1]
- rebase to 7.2.7 for CVE-2024-46981 and CVE-2024-51741

[7.2.6-1]
- rebase to 7.2.6 RHEL-26628

Fixed packages 3

ReleasePackageFixed in
Oracle Linux · 9 redis 0:7.2.11-1.0.1.module+el9.7.0+90709+dc2ec98a
Oracle Linux · 9 redis-devel 0:7.2.11-1.0.1.module+el9.7.0+90709+dc2ec98a
Oracle Linux · 9 redis-doc 0:7.2.11-1.0.1.module+el9.7.0+90709+dc2ec98a

Vulnerabilities 4

  • Critical 10.0
    CVE-2025-49844 Public exploit Scanner template EPSS 83%

    Redis Lua Use-After-Free may lead to remote code execution

    Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code exe…

    Redis Redis redis redis Debian Ubuntu Azure Linux Alpine
  • High 7.0
    CVE-2025-46817 Public exploit Scanner template

    Lua library commands may lead to integer overflow and potential RCE

    Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to cause an integer overflow and potentially lead to remote code execution The problem exists in all …

    Redis Redis redis redis Debian Ubuntu Azure Linux Alpine
  • Medium 6.3
    CVE-2025-46819 Public exploit Scanner template

    Redis is vulnerable to DoS via specially crafted LUA scripts

    Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted LUA script to read out-of-bound data or crash the server and subsequent denial of service. The problem exists in…

    Redis Redis redis redis Debian Ubuntu Azure Linux Alpine
  • Medium 6.0
    CVE-2025-46818 Public exploit Scanner template

    Redis: Authenticated users can execute LUA scripts as a different user

    Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate different LUA objects and potentially run their own code in the context of another user…

    Redis Redis redis redis Debian Ubuntu Azure Linux Alpine