Critical Security Update for Redis: Addressing Multiple Vulnerabilities
Summary
ALSA-2025:20955: Important: redis:7 security update. Affects redis versions < 7.2.11-1.module_el9.6.0+188+92104ce8. Fixed in 7.2.11-1.module_el9.6.0+188+92104ce8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Redis is an advanced key-value store often referred to as a data-structure server due to its ability to handle various data types such as strings, hashes, lists, sets, and sorted sets. It operates primarily in-memory for performance, allowing for quick data access and manipulation. However, recent vulnerabilities have been identified that could compromise its security, particularly through the Lua scripting capabilities.
Vulnerability Detail
The vulnerabilities in Redis stem from its Lua library commands, which may lead to integer overflow and potential remote code execution (CVE-2025-46817). Authenticated users can execute Lua scripts as different users (CVE-2025-46818), and specially crafted Lua scripts can cause denial of service (CVE-2025-46819). Additionally, a use-after-free vulnerability in Redis Lua could also lead to remote code execution (CVE-2025-49844). These vulnerabilities pose significant risks, allowing unauthorized access and potential system compromise.
How To Fix
Minimum fixed version
7.2.11-1.module_el9.6.0+188+92104ce8
This is the first release that contains the fix.
sudo dnf update redisTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can restrict access to the Redis server by configuring firewall rules to limit connections to trusted IP addresses only. Additionally, disabling Lua scripting can mitigate some risks until the update is applied. This can be done by setting 'lua-disabled' in the Redis configuration file.
Conclusion
The identified vulnerabilities in Redis pose significant risks that can lead to unauthorized access and system compromise. It is crucial to update to the patched version to ensure the security of your Redis installation. Implementing temporary workarounds can help mitigate risks until the update is applied.
See every vulnerability recorded for redis →
FAQ
Redis is an advanced key-value store that functions as a data-structure server, allowing for efficient data storage and retrieval.
The main vulnerabilities include integer overflow, unauthorized Lua script execution, denial of service via crafted scripts, and use-after-free issues.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by these vulnerabilities without needing to sign up.
If immediate updates are not possible, consider implementing firewall rules to restrict access and disabling Lua scripting as a temporary workaround.
For detailed information, refer to the CVE pages listed in the vulnerability report, which provide insights into the impact and technical details.
Related vulnerabilities
Recent vulnerabilities recorded for redis.
