EUVD-2025-33178CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionNVD
Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.
AnalysisAI
UAF in Redis 8.2.1 via crafted Lua scripts by authenticated users. EPSS 12.4%. Patch available.
Technical ContextAI
CWE-416 in Redis Lua scripting engine.
RemediationAI
Update Redis.
More from same product – last 7 days
Command injection in the shell-quote npm package allows attackers who can influence object-token inputs to inject arbitr
Heap buffer overflow in NGINX Plus and NGINX Open Source ngx_http_rewrite_module allows unauthenticated remote attackers
Vendor StatusVendor
Ubuntu
Priority: High| Release | Status | Version |
|---|---|---|
| jammy | DNE | - |
| noble | DNE | - |
| upstream | needs-triage | - |
| plucky | released | 7.3.2+ds-1ubuntu0.1 |
| questing | released | 7.3.5+ds-1ubuntu0.1 |
| Release | Status | Version |
|---|---|---|
| bionic | released | 5:4.0.9-1ubuntu0.2+esm6 |
| focal | released | 5:5.0.7-2ubuntu0.1+esm4 |
| jammy | released | 5:6.0.16-1ubuntu1.1 |
| upstream | released | 8.2.2 |
| noble | released | 5:7.0.15-1ubuntu0.24.04.2 |
| plucky | released | 5:7.0.15-3ubuntu0.1 |
| questing | released | 5:8.0.2-3ubuntu0.25.10.1 |
| trusty | released | 2:2.8.4-2ubuntu0.2+esm5 |
| xenial | released | 2:3.0.6-1ubuntu0.4+esm4 |
| Release | Status | Version |
|---|---|---|
| jammy | DNE | - |
| upstream | needs-triage | - |
| noble | released | 7.2.11+dfsg1-0ubuntu0.2 |
| questing | released | 8.1.4+dfsg1-0ubuntu0.2 |
| plucky | released | 8.0.6+dfsg1-0ubuntu0.2 |
Debian
Bug #1117690| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| forky, sid | fixed | 7.3.6+ds-1 | - |
| (unstable) | fixed | 7.3.6+ds-1 | - |
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | fixed | 5:6.0.16-1+deb11u8 | - |
| bullseye (security) | fixed | 5:6.0.16-1+deb11u8 | - |
| bookworm, bookworm (security) | fixed | 5:7.0.15-1~deb12u6 | - |
| trixie (security), trixie | fixed | 5:8.0.2-3+deb13u1 | - |
| forky, sid | fixed | 5:8.0.5-1 | - |
| bookworm | fixed | 5:7.0.15-1~deb12u6 | - |
| trixie | fixed | 5:8.0.2-3+deb13u1 | - |
| (unstable) | fixed | 5:8.0.4-1 | - |
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| trixie (security), trixie | fixed | 8.1.1+dfsg1-3+deb13u1 | - |
| forky, sid | fixed | 8.1.4+dfsg1-1 | - |
| trixie | fixed | 8.1.1+dfsg1-3+deb13u1 | - |
| (unstable) | fixed | 8.1.4+dfsg1-1 | - |
Share
External POC / Exploit Code
Leaving vuln.today