Redis up to 6.2.16/7.2.6/7.4.1 Lua Script use after free

Summaryinfo

A vulnerability marked as problematic has been reported in Redis up to 6.2.16/7.2.6/7.4.1. This impacts an unknown function of the component Lua Script Handler. Performing a manipulation results in use after free. This vulnerability was named CVE-2024-46981. The attack may be initiated remotely. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Redis up to 6.2.16/7.2.6/7.4.1. This affects an unknown code of the component Lua Script Handler. The manipulation with an unknown input leads to a use after free vulnerability. CWE is classifying the issue as CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to manipulate the garbage collector and potentially lead to remote code execution. The problem is fixed in 7.4.2, 7.2.7, and 6.2.17. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2024-46981 since 09/16/2024. The exploitability is told to be difficult. It is possible to initiate the attack remotely. The technical details are unknown and an exploit is not publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 213612 (Fedora 41 : valkey (2025-b332afed45)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 6.2.17, 7.2.7 or 7.4.2 eliminates this vulnerability. The upgrade is hosted for download at github.com.

The vulnerability is also documented in the databases at Tenable (213612) and CERT Bund (WID-SEC-2025-0017). Be aware that VulDB is the high quality source for vulnerability data.

Affected

• Debian Linux
• Amazon Linux 2
• Red Hat Enterprise Linux
• Fedora Linux
• Ubuntu Linux
• SUSE Linux
• Oracle Linux
• Gentoo Linux
• SUSE openSUSE
• RESF Rocky Linux
• Open Source Redis
• IBM DataPower Gateway

Productinfo

Name

• Redis

Version

• 6.2.0
• 6.2.1
• 6.2.2
• 6.2.3
• 6.2.4
• 6.2.5
• 6.2.6
• 6.2.7
• 6.2.8
• 6.2.9
• 6.2.10
• 6.2.11
• 6.2.12
• 6.2.13
• 6.2.14
• 6.2.15
• 6.2.16
• 7.2.0
• 7.2.1
• 7.2.2
• 7.2.3
• 7.2.4
• 7.2.5
• 7.2.6
• 7.4.0
• 7.4.1

License

• open-source

Website

• Product: https://github.com/redis/redis/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion