Critical Security Update for Redis: Addressing Multiple Vulnerabilities
Summary
ALSA-2025:20926: Important: redis security update. Affects redis versions < 6.2.20-2.el9_7. Fixed in 6.2.20-2.el9_7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Redis is an advanced key-value store often referred to as a data-structure server, allowing keys to contain various data types such as strings, hashes, lists, sets, and sorted sets. It operates primarily in-memory for performance, with options for data persistence through periodic dumps or command logging. This flexibility makes Redis a popular choice for caching and real-time analytics, but it also exposes it to specific security vulnerabilities.
Vulnerability Detail
The vulnerabilities in Redis stem from issues in its Lua library commands, which can lead to integer overflow and potential remote code execution (RCE). Authenticated users may exploit these vulnerabilities to execute Lua scripts as different users, potentially causing denial of service (DoS) through specially crafted scripts. Additionally, a use-after-free vulnerability in Redis Lua can also lead to RCE, making it critical to address these security flaws promptly.
How To Fix
Minimum fixed version
6.2.20-2.el9_7
This is the first release that contains the fix.
sudo dnf update redisTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider restricting access to the Redis server by implementing firewall rules or using authentication mechanisms to limit who can execute Lua scripts. This can help mitigate the risk until the update is applied.
Conclusion
The Redis security update addresses critical vulnerabilities that could lead to severe consequences, including remote code execution and denial of service. It is imperative for users to update to the latest version to safeguard their systems. Implementing workarounds can provide temporary relief, but a full update is the best course of action.
See every vulnerability recorded for redis →
FAQ
The main vulnerabilities include integer overflow leading to RCE, unauthorized execution of Lua scripts by authenticated users, DoS via crafted Lua scripts, and a use-after-free vulnerability that can also lead to RCE.
You can check your Redis version by running 'redis-server --version' in your terminal. If your version is below 6.2.20-2.el9_7, it is affected by the vulnerabilities.
Yes, you can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json. You can also check your application against known vulnerabilities using the Vulert playground.
If an immediate update is not possible, implement strict access controls and firewall rules to limit exposure. Regularly review logs for any suspicious activity.
For more details, refer to the CVE pages associated with the vulnerabilities: CVE-2025-46817, CVE-2025-46818, CVE-2025-46819, and CVE-2025-49844.
Related vulnerabilities
Recent vulnerabilities recorded for redis.
