CVE-2022-0543

As of 2025-10-21, CVE-2022-0543 is a CVSS 10 (CRITICAL-severity) vulnerability. CISA KEV-listed (known exploited). EPSS exploitation probability 94.4%. Threadlinqs Intelligence tracks 1 threat exploiting it.

Last updated: 2025-10-21

It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.

CVSS v3 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weaknesses (CWE)

CWE-862

Exploitation status

CISA KEV-listed (known exploited)

Threats tracking this CVE

• P2Pinfect Kubernetes Compromise — Exposed Redis Enables Persistent GKE Botnet Enrollment with Six-Month Dormancy (CVE-2022-0543, CVE-2025-11953, CVE-2025-49844) — HIGH

References

• https://bugs.debian.org/1005787
• https://www.ubercomp.com/posts/2022-01-20_redis_on_debian_rce
• https://lists.debian.org/debian-security-announce/2022/msg00048.html
• https://www.debian.org/security/2022/dsa-5081
• https://security.netapp.com/advisory/ntap-20220331-0004/
• http://packetstormsecurity.com/files/166885/Redis-Lua-Sandbox-Escape.html

← all vulnerabilities · Markdown version · Threadlinqs Intelligence

Enriched from CVE.org, NVD (this product uses the NVD API but is not endorsed or certified by the NVD), FIRST EPSS, CISA KEV, and GitHub Security Advisories.