Skip to main content
cvebuzz

CVE mentions, exploit signals, and PoC evidence in one fast public view.

CVE detail

CVE-2025-49844

Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.

CVSS 9.9 · CriticalBuzz score 55.52 public exploit repository references

Buzz score

Why this CVE is surfacing

Buzz score total 55.5

This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.

Buzz score components · mention 24.0 · diversity 19.5 · KEV 0.0 · OTX 0.0 · PoC 12.0
Mention score
24.0
10 evidence mentions in the snapshot
Diversity score
19.5
6 sources across 3 categories
KEV score
0.0
No KEV entry observed
OTX score
0.0
0 OTX pulses
PoC score
12.0
2 repos · best confidence 0.99
Best PoC traction
3
Maximum stars on a matched PoC repo

Why it matters now

Mention timeline

Total mentions
0
within the 30d window
Peak daily
0
highest bucket

Evidence

Source links by recency

Newest mentions first
10 source links · newest first
  • 14 old software bugs that took way too long to squashCSO Online

    In 2021, a vulnerability was revealed in a system that lay at the foundation of modern computing. An attacker could force the system to execute arbitrary code. Shockingly, the vulnerable code was almost 54 years old — and there was no patch available, and no expectation that one would be forthcoming. Fortunately, that’s because the […]

    newswww.csoonline.comMar 5, 2026, 6:30 AM
  • Security Affairs newsletter Round 546 by Pierluigi Paganini – INTERNATIONAL EDITIONSecurity Affairs

    A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. Winos 4.0 hackers expand to Japan and Malaysia with new malware From Airport chaos to cyber […]

    newssecurityaffairs.comOct 19, 2025, 1:37 PM
  • 13th October – Threat Intelligence ReportCheck Point Research

    For the latest discoveries in cyber research for the week of 13th October, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Qilin ransomware group has claimed responsibility for targeting Asahi, Japan’s largest brewing company, that had been hacked on September 29th. The attack resulted in the exfiltration of over 9,300 files totaling 27GB […]

    vendorresearch.checkpoint.comOct 13, 2025, 8:53 AM
  • Security Affairs newsletter Round 545 by Pierluigi Paganini – INTERNATIONAL EDITIONSecurity Affairs

    A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. CVE-2025-11371: Unpatched zero-day in Gladinet CentreStack, Triofox under attack Cybercrime ring GXC Team dismantled in Spain, […]

    newssecurityaffairs.comOct 12, 2025, 12:16 PM
  • Week in review: Hackers extorting Salesforce, CentreStack 0-day exploitedHelp Net Security

    Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: How to get better results from bug bounty programs without wasting money The wrong bug bounty strategy can flood your team with low-value reports. The right one can surface critical vulnerabilities that would otherwise slip through. A new academic study based on Google’s Vulnerability Rewards Program (VRP) offers rare data on how to tell the difference. Rethinking AI security architectures … More →

    newswww.helpnetsecurity.comOct 12, 2025, 8:00 AM
  • CVE-2025-49844Horizon3.ai

    Redis Lua Use-After-Free Vulnerability | Critical RCE Risk

    exploithorizon3.aiOct 9, 2025, 9:17 PM
  • Redis patches 13-Year-Old Lua flaw enabling Remote Code ExecutionSecurity Affairs

    Redis warns of CVE-2025-49844, a Lua script flaw enabling RCE via use-after-free. Attackers need authenticated access to exploit it. Redis disclosed a critical RCE bug, tracked as CVE-2025-49844 (also known as “RediShell”, with a CVSS score of 10.0), where a malicious Lua script can exploit the garbage collector to trigger a use-after-free vulnerability and enable […]

    newssecurityaffairs.comOct 8, 2025, 9:10 AM
  • 10.0-severity RCE flaw puts 60,000 Redis instances at riskCSO Online

    The popular Redis in-memory data store received a patch for a critical vulnerability that leads to remote code execution on the server hosting the database. While the flaw requires authentication to exploit, many Redis instances don’t have authentication configured and around 60,000 of them are exposed to the internet in this configuration. “Given that Redis […]

    newswww.csoonline.comOct 7, 2025, 8:45 PM
  • Redis patches critical “RediShell” RCE vulnerability, update ASAP! (CVE-2025-49844)Help Net Security

    Redis, the company behind the widely used in-memory data structure store of the same name, has released patches for a critical vulnerability (CVE-2025-49844) that may allow attackers full access to the underlying host system. “This flaw allows a post auth attacker to send a specially crafted malicious Lua script (a feature supported by default in Redis) to escape from the Lua sandbox and achieve arbitrary native code execution on the Redis host,” Wiz researchers noted. … More →

    newswww.helpnetsecurity.comOct 7, 2025, 1:36 PM
  • Critical Vulnerability Puts 60,000 Redis Servers at Risk of ExploitationSecurityWeek

    Authenticated attackers can exploit the security flaw to trigger a use-after-free and potentially execute arbitrary code.

    newswww.securityweek.comOct 7, 2025, 8:32 AM

Exploit code

Public exploit repository references

Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.

2 repository references · best confidence 0.99 · max 3 stars

Related records

Similar CVEs

6 related CVEs with shared weakness or product evidence
  • CVE-2026-23631

    Redis is an in-memory data structure store. In all versions of redis-server with Lua scripting, an authenticated attacker can exploit the master-replica synchronization mechanism…

    CVSS 6.1 · Medium
    13 mentions
  • CVE-2026-23479

    Redis is an in-memory data structure store. In redis-server from 7.2.0 until 8.6.3, the unblock client flow does not handle an error return from `processCommandAndResetClient` whe…

    CVSS 7.7 · High
    13 mentions
  • CVE-2024-46981

    Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to manipulate the garbage collector and potentially…

    CVSS 7.0 · High
  • CVE-2025-21605

    Redis is an open source, in-memory database that persists on disk. In versions starting at 2.6 and prior to 7.4.3, An unauthenticated client can cause unlimited growth of output b…

    CVSS 7.5 · High
    6 mentions
  • CVE-2026-51304

    sqlite 3.41 has a use-after-free (UAF) vulnerability in the ORDER BY clause parsing routine. The affected code first releases the memory of an ExprList object via sqlite3ExprListD…

    CVSS 7.5 · High
    2 mentions
  • CVE-2026-51303

    A use-after-free (UAF) vulnerability was discovered in the core parsing component of SQLite 3.41. The flaw occurs because the program frees an ExprList object via sqlite3ExprListD…

    CVSS 9.8 · Critical
    2 mentions