Critical Security Update for Redis: Addressing Multiple Vulnerabilities
Summary
ALSA-2025:19237: Important: redis security update. Affects redis versions < 6.2.20-1.el9_6. Fixed in 6.2.20-1.el9_6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Redis is an advanced key-value store often referred to as a data-structure server, capable of handling various data types such as strings, hashes, lists, sets, and sorted sets. It operates primarily in-memory for performance, with options for data persistence through periodic dumps or command logging. However, recent vulnerabilities have been identified that could compromise its security.
Vulnerability Detail
The vulnerabilities in Redis stem from issues within its Lua library commands, which may lead to integer overflow and potential remote code execution (CVE-2025-46817). Additionally, authenticated users can execute Lua scripts as different users (CVE-2025-46818), and specially crafted Lua scripts can cause denial of service (CVE-2025-46819). A use-after-free vulnerability in Redis Lua can also lead to remote code execution (CVE-2025-49844). These vulnerabilities pose significant risks, including unauthorized access and system instability.
How To Fix
Minimum fixed version
6.2.20-1.el9_6
This is the first release that contains the fix.
sudo dnf update redisTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the Redis server by implementing firewall rules or using Redis' built-in authentication features to limit user permissions until the update can be applied.
Conclusion
The identified vulnerabilities in Redis pose serious security risks that can lead to unauthorized access and system instability. It is crucial to update to the patched version 6.2.20-1.el9_6 to mitigate these risks effectively. Additionally, temporary workarounds can help secure your installation until the update is applied.
See every vulnerability recorded for redis →
FAQ
The main vulnerabilities include integer overflow leading to remote code execution, unauthorized execution of Lua scripts by authenticated users, denial of service via crafted Lua scripts, and a use-after-free vulnerability in Lua.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. By utilizing the Vulert playground, you can check if your application is affected without any signup.
The vulnerabilities can lead to unauthorized access, remote code execution, and denial of service, which can compromise the integrity and availability of your Redis instance.
Yes, you can implement firewall rules to restrict access to the Redis server and use built-in authentication features to limit user permissions until the update is applied.
If immediate updates are not possible, ensure that your Redis server is not exposed to the internet and consider implementing strict access controls to minimize risks.
Related vulnerabilities
Recent vulnerabilities recorded for redis.
