Intrusion PreventionRedis.luaY_parser.Use.After.Free
Description
This indicates an attack attempt to exploit a Use After Free vulnerability in Redis.
The vulnerability is due to improper handling of Lua scripting within Redis. A remote attacker can exploit this vulnerability by sending crafted Lua script requests. Successful exploitation could lead to remote code execution.
Affected Products
Redis OSS/CE releases with Lua scripting prior to 8.2.2
Redis OSS/CE releases with Lua scripting prior to 8.0.4
Redis OSS/CE releases with Lua scripting prior to 7.4.6
Redis OSS/CE releases with Lua scripting prior to 7.2.11
Redis Stack releases with Lua scripting prior to 7.4.0-v7
Redis Stack releases with Lua scripting prior to 7.2.0-v19
Redis Software releases prior to 7.22.2-12
Redis Software releases prior to 7.8.6-207
Redis Software releases prior to 7.4.6-272
Redis Software releases prior to 7.2.4-138
Redis Software releases prior to 6.4.2-131
Impact
System Compromise: Remote attackers can gain control of vulnerable systems.
Recommended Actions
Apply the most recent upgrade or patch from the vendor.
https://redis.io/blog/security-advisory-cve-2025-49844/
Coverage
| IPS (Regular DB) | |
| IPS (Extended DB) |
Version Updates
| ID | 59206 |
| Created | Oct 09, 2025 |
| Updated | Dec 11, 2025 |
| CVE ID | |
| Tags | Threat Signal |
| Risk |
|
| Exploit Prediction Score | 12.43% |
| Default Action | drop |
| Active | |
| Affected OS | Linux, BSD, MacOS |
| Affected App | Other |
| Profile Type | BufferErrors |