Summary
Benny Isaacs, Nir Brakha, and Sagi Tzadik discovered that Redis incorrectly
handled memory when running Lua scripts. An authenticated attacker could
use this vulnerability to trigger a use-after-free condition, and
potentially achieve remote code execution on the Redis server.
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 24.04 LTS 24.04:LTS | redis | 5:7.0.15-1ubuntu0.24.04.2 |
| Ubuntu · 25.10 | redis | 5:8.0.2-3ubuntu0.25.10.1 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | redis | 2:2.8.4-2ubuntu0.2+esm5 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | redis | 2:3.0.6-1ubuntu0.4+esm4 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | redis | 5:4.0.9-1ubuntu0.2+esm6 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | redis | 5:5.0.7-2ubuntu0.1+esm4 |
Vulnerabilities 1
-
Critical 10.0
Redis Lua Use-After-Free may lead to remote code execution
Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code exe…
References
-
report
https://ubuntu.com/security/CVE-2025-49844