Redis Warns of Critical Flaw Impacting Thousands of Instances
A critical vulnerability has been discovered in the open-source data structure store Redis, allowing attackers to gain remote code execution on thousands of vulnerable instances. The security flaw, tracked as CVE-2025-49844, was identified by the Redis security team and patched earlier this month.
According to a report from BleepingComputer, the vulnerability is caused by a 13-year-old use-after-free weakness found in the Redis source code. Authenticated threat actors can exploit the flaw using a specially crafted Lua script, which is enabled by default. Successful exploitation enables attackers to escape the Lua sandbox, trigger a use-after-free, establish a reverse shell for persistent access, and achieve remote code execution on the targeted Redis hosts.
"The severity of this vulnerability is maximum," said a spokesperson for the Redis security team. "We urge all users to update their instances as soon as possible."
Redis is used in approximately 75% of cloud environments, functioning like a database, cache, and message broker. It stores data in RAM for ultra-fast access, making it a critical component in many organizations' infrastructure.
The vulnerability has significant implications for cloud security, allowing attackers to steal credentials, deploy malware or cryptocurrency mining tools, extract sensitive data from Redis, move laterally to other systems within the victim's network, or use stolen information to gain access to other cloud environments.
"This is a wake-up call for organizations that rely on Redis," said Chris Eng, Chief Research Officer at Veracode. "They need to take immediate action to patch their instances and ensure they are not vulnerable to this exploit."
The Redis security team has released patches for the vulnerability, which can be downloaded from the official Redis website. Users are advised to update their instances as soon as possible to prevent exploitation.
In response to the discovery of the vulnerability, cloud providers such as Amazon Web Services (AWS) and Microsoft Azure have issued statements urging users to update their Redis instances.
"AWS takes the security of our customers' data seriously," said an AWS spokesperson. "We recommend that all users update their Redis instances to the latest version to prevent exploitation."
The discovery of the vulnerability highlights the importance of regular security updates and patches in preventing cyber attacks. As organizations continue to rely on open-source software, the need for robust security measures becomes increasingly critical.
In a statement, the Redis project lead said, "We appreciate the efforts of our community in identifying this vulnerability and working with us to develop a patch. We will continue to work closely with our users to ensure the security and stability of Redis."
The current status of the vulnerability is that patches have been released, but many instances remain unpatched. The next developments include ongoing monitoring by the Redis security team and continued efforts to educate users about the importance of regular updates and patches.
As the situation continues to unfold, it remains to be seen how widespread the exploitation of this vulnerability will be. However, one thing is clear: organizations must take immediate action to protect their data and prevent potential cyber attacks.
*Reporting by It.*
