CVE-2025-49844
RediShell: Lua use-after-free reachable from a crafted EVAL script -> remote code execution (CVSS 10.0)
- Severity
- critical
- Affected product
- Redis
- Affected versions
- Redis ≥ 7.0.0, < 7.2.11
- Affected versions
- Redis ≥ 7.4.0, < 7.4.6
- Affected versions
- Redis ≥ 8.0.0, < 8.0.4
- Affected versions
- Redis ≥ 8.2.0, < 8.2.2
- Fixed in
- Redis 7.2.11 / 7.4.6 / 8.0.4 / 8.2.2
- Added to NewScan
- 2026-08-06
- Detected by
- NewScan — free, self-hosted
How NewScan reports it
COMPONENT VERSION RANGE
NewScan fingerprints Redis from its response and reports this CVE when the detected version falls inside the affected range below.
Ranges taken from the Redis security advisory (2026-08-05 review), not inferred. Redis backports per maintained branch, so each CVE is ONE ROW PER BRANCH the advisory names a fixed version for - a branch the advisory does not list gets no row rather than a guessed range, so an older patched line is never falsely flagged. Every Redis build with Lua scripting is affected; exploitation needs authenticated access, which an unauthenticated instance grants to anyone who can reach the port.
COMPONENT VERSION RANGE
NewScan fingerprints Redis from its response and reports this CVE when the detected version falls inside the affected range below.
Ranges taken from the Redis security advisory (2026-08-05 review), not inferred. Redis backports per maintained branch, so each CVE is ONE ROW PER BRANCH the advisory names a fixed version for - a branch the advisory does not list gets no row rather than a guessed range, so an older patched line is never falsely flagged. Every Redis build with Lua scripting is affected; exploitation needs authenticated access, which an unauthenticated instance grants to anyone who can reach the port.
COMPONENT VERSION RANGE
NewScan fingerprints Redis from its response and reports this CVE when the detected version falls inside the affected range below.
Ranges taken from the Redis security advisory (2026-08-05 review), not inferred. Redis backports per maintained branch, so each CVE is ONE ROW PER BRANCH the advisory names a fixed version for - a branch the advisory does not list gets no row rather than a guessed range, so an older patched line is never falsely flagged. Every Redis build with Lua scripting is affected; exploitation needs authenticated access, which an unauthenticated instance grants to anyone who can reach the port.
COMPONENT VERSION RANGE
NewScan fingerprints Redis from its response and reports this CVE when the detected version falls inside the affected range below.
Ranges taken from the Redis security advisory (2026-08-05 review), not inferred. Redis backports per maintained branch, so each CVE is ONE ROW PER BRANCH the advisory names a fixed version for - a branch the advisory does not list gets no row rather than a guessed range, so an older patched line is never falsely flagged. Every Redis build with Lua scripting is affected; exploitation needs authenticated access, which an unauthenticated instance grants to anyone who can reach the port.
References
Scan for this yourself — local, in-band scanning is free.
Get NewScan (FREE) →