Threat Intelligence / CVE / CVE-2025-49844

CVE-2025-49844 — redis

CVSS v3.1 10 (CRITICAL) · EPSS 11.1% (higher than 93.5% of all scored CVEs) · Priority 8.7/10 · Published 2025-10-03

As of 2026-03-20, CVE-2025-49844 is a CRITICAL-severity vulnerability in redis, CVSS v3.1 10, EPSS 11.1% (93.5th percentile). Threadlinqs Intelligence links 1 tracked threat campaign to CVE-2025-49844, most recently “P2Pinfect Kubernetes Compromise — Exposed Redis Enables Persistent GKE Botnet Enrollment with Six-Month Dormancy (CVE-2022-0543, CVE-2025-11953, CVE-2025-49844)”.

Last updated: 2026-03-20

What is CVE-2025-49844?

Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.

The record classifies CVE-2025-49844 under weakness class CWE-416. Its CVSS v3 base vector states that the flaw is reachable remotely over the network, needs low-privilege credentials, needs no user interaction, and has high impact on confidentiality, integrity, availability. 1 affected-product entry is recorded, across 1 vendor, listed below. The identifier was first published 345 days ago.

Severity and exploitation probability

CVSS v3.1 base score: 10 — CRITICAL
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS (FIRST): 11.1% probability of exploitation in the next 30 days, higher than 93.5% of all scored CVEs
CISA KEV: Not listed in the CISA Known Exploited Vulnerabilities catalog
Threadlinqs priority: 8.7/10 — a Threadlinqs composite of the CVSS base score, the EPSS percentile and public exploit availability
Published: 2025-10-03, last modified 2026-03-20

Is CVE-2025-49844 being exploited?

It currently carries a trending score of 28 in the Threadlinqs vulnerability feed.

Affected products and versions

redis: redis

How to fix CVE-2025-49844

No vendor patch reference has been recorded for CVE-2025-49844 in the tracked sources. Follow the references below for a fix, and treat the products listed above as exposed until the vendor states otherwise.

Threat activity tracking CVE-2025-49844

1 tracked threat in the Threadlinqs corpus references CVE-2025-49844, either in the campaign’s CVE list or as an indicator on the campaign record.

P2Pinfect Kubernetes Compromise — Exposed Redis Enables Persistent GKE Botnet Enrollment with Six-Month Dormancy (CVE-2022-0543, CVE-2025-11953, CVE-2025-49844) — HIGH · 2026-05-21

Sources

Seeded from cveorg and not yet processed by the Threadlinqs enrichment pipeline, so blank CVSS, EPSS or KEV fields above mean NOT MEASURED rather than measured-absent.

Full detection coverage & IOCs for threats exploiting CVE-2025-49844 are available via the Threadlinqs MCP server (Purple tier). View plans →

← all vulnerabilities · Markdown version · Threadlinqs Intelligence