Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-23 | 1 | PoC1 |
| 2026-03-24 | 1 | Disclosure1 |
| 2026-04-19 | 1 | Patch1 |
| 2026-07-09 | 1 | Disclosure1 |
| 2026-08-31 | 1 | Disclosure1 |
| 2026-09-23 | 1 | Disclosure1 |
Apache Kvrocks affected by CVE-2024-31449 and CVE-2025-49844 (Redis Lua); fixed but no formal advisory https://www.openwall.com/lists/oss-security/2026/04/16/6
Post summary
Apache Kvrocks is affected by CVE‑2024‑31449 and CVE‑2025‑49844 (Redis Lua), which have been fixed but no formal advisory has yet been issued.
LOOK BACK — Redis shipped Lua scripting in 2012 on a frozen copy of the Lua 5.1 interpreter. CVE-2025-49844 hid a use-after-free in that ~13-year-old code: CVSS 9.9, sandbox escape to RCE. The forecast said exploits within days — 9 months on, it's quiet. https://t.co/ClW3JjZGUU
Post summary
The tweet announces that CVE‑2025‑49844 in Redis’s Lua scripting involves a use‑after‑free leading to sandbox escape and remote code execution, noting the high CVSS score but no known exploitation or available patch.
Redis has a critical UAF flaw (CVE-2025-49844) up to 8.2.1. The vulnerability allows remote code execution via Lua scripting. How are you isolating access to script commands? #Redis #Security #UAF #CVE
Post summary
The tweet announces CVE-2025-49844, a critical UAF flaw in Redis up to 8.2.1 that enables remote code execution via Lua scripting, without mentioning patches, exploits, or active exploitation.
Redis has disclosed details of a maximum-severity security flaw in its in-memory database software that could result in remote code execution under certain circumstances. The vulnerability, tracked as CVE-2025-49844 (ak... https://f.mtr.cool/2bbtyupxhq
Post summary
Redis announces a new maximum‑severity vulnerability (CVE‑2025‑49844) that may lead to remote code execution under certain conditions, with no evidence of exploitation, PoC, or available patches yet.
🚨 BREAKING: Schneider Electric Plant iT/Brewmaxx vulnerabilities could lead to privilege escalation and remote code execution. Versions 9.60 and above are affected. Stay alert for updates on CVE-2025-49844, CVE-2025-46817. #CyberSecurity #BreakingNews
Post summary
The post announces two new CVEs (CVE-2025-49844, CVE-2025-46817) impacting Schneider Electric Plant iT/Brewmaxx, highlighting potential privilege escalation and remote code execution in versions 9.60 and above, without any exploit code or patch information.
I just published RediShell Unmasked: Escaping the Redis Lua Sandbox (CVE-2025–49844) https://medium.com/p/redishell-unmasked-escaping-the-redis-lua-sandbox-cve-2025-49844-185509897900?source=social.tw
Post summary
A Medium article was published detailing a proof‑of‑concept for escaping the Redis Lua sandbox (CVE‑2025‑49844).
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | lfprojects | valkey | - | - | - |
| App | redis | redis | - | - | - |