Description
Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua bytecode via the eval command.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | redis | 2:3.0.2-1 | — |
| Debian 13 | redis | 2:3.0.2-1 | — |
| Debian 12 | redis | 2:3.0.2-1 | — |
| Debian 8 | redis | 2:2.8.17-1+deb8u1 | DSA-3279-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | redis | 2:2.8.4-2ubuntu0.2 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 6 | redis | 2.8.21-1.el7ost | RHSA-2015:1676 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | compat-lua | No fix yet | — |
Advisories 2
- DSA-3279-1 redis - security update Debian Security (DSA / DLA) · Mar 9, 2026
- RHSA-2015:1676 Red Hat Security Advisory: redis security advisory Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- https://github.com/antirez/redis/commit/fdf9d455098f54f7666c702ae464e6ea21e25411
- FEDORA-2015-9498 vendor-advisory
- [oss-security] 20150604 CVE Request: redis Lua sandbox escape and arbitrary code execution mailing-list
- [oss-security] 20150604 Re: CVE Request: redis Lua sandbox escape and arbitrary code execution mailing-list
- openSUSE-SU-2015:1687 vendor-advisory
- FEDORA-2015-9488 vendor-advisory
- RHSA-2015:1676 vendor-advisory
- https://groups.google.com/forum/#%21msg/redis-db/4Y6OqK8gEyk/Dg-5cejl-eUJ
- 75034 vdb-entry
- [oss-security] 20150605 Re: CVE Request: redis Lua sandbox escape and arbitrary code execution mailing-list
- GLSA-201702-16 vendor-advisory
- http://benmmurphy.github.io/blog/2015/06/04/redis-eval-lua-sandbox-escape/
- DSA-3279 vendor-advisory