Critical Security Update for Redis: Addressing Multiple Vulnerabilities
Summary
ALSA-2025:19345: Important: redis:7 security update. Affects redis versions < 7.2.11-1.module_el9.6.0+188+92104ce8. Fixed in 7.2.11-1.module_el9.6.0+188+92104ce8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Redis is an advanced key-value store often referred to as a data-structure server, allowing users to store various data types such as strings, hashes, lists, sets, and sorted sets. It operates primarily in-memory for performance, with options for data persistence. This flexibility makes Redis a popular choice for caching and real-time analytics. However, recent vulnerabilities have been identified that could compromise the security and integrity of Redis installations.
Vulnerability Detail
The vulnerabilities in Redis stem from issues within its Lua library commands, which may lead to integer overflow and potential remote code execution (CVE-2025-46817). Authenticated users can execute Lua scripts as different users (CVE-2025-46818), and specially crafted Lua scripts can cause denial of service (CVE-2025-46819). Additionally, a use-after-free vulnerability in Redis Lua could also lead to remote code execution (CVE-2025-49844). These vulnerabilities pose significant risks, including unauthorized access and service disruption.
How To Fix
Minimum fixed version
7.2.11-1.module_el9.6.0+188+92104ce8
This is the first release that contains the fix.
sudo dnf update redisTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider restricting access to the Redis server by implementing firewall rules or using Redis' built-in authentication features to limit script execution by unauthorized users.
Conclusion
The identified vulnerabilities in Redis pose significant security risks that could lead to unauthorized access and service disruption. It is crucial to update to the latest patched version to safeguard your installations. Implementing temporary workarounds can help mitigate risks until updates are applied.
See every vulnerability recorded for redis →
FAQ
Redis is an advanced key-value store that functions as a data-structure server, allowing for the storage of various data types and providing high performance through in-memory operations.
The main vulnerabilities include integer overflow leading to remote code execution, unauthorized script execution by authenticated users, denial of service via crafted Lua scripts, and a use-after-free vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by these vulnerabilities without requiring any signup.
If immediate updates are not possible, implement firewall rules and use Redis' authentication features to limit access and mitigate risks until the update can be performed.
For more details, refer to the CVE pages listed in the vulnerability report, which provide in-depth information about each identified issue.
Related vulnerabilities
Recent vulnerabilities recorded for redis.
