In October 2025 Debian fixed four vulnerabilities in the Lua scripting engine shared by Redis and its fork Valkey: DSA-6020-1 for redis on 8 October and DSA-6022-1 for valkey a day later. The most serious, CVE-2025-49844, is a use-after-free that may let a connected client run code on the server. Newer Redis and Valkey packages released since then also contain these fixes.
At a glance
| Item | Details |
|---|---|
| Source packages | redis (Debian 12 and 13), valkey (Debian 13) |
| Fixed versions | redis 5:7.0.15-1~deb12u6 (bookworm), redis 5:8.0.2-3+deb13u1 (trixie), valkey 8.1.1+dfsg1-3+deb13u1 (trixie) |
| Advisories | DSA-6020-1 (8 Oct 2025), DSA-6022-1 (9 Oct 2025), DLA-4325-1 for Debian 11 (9 Oct 2025) |
| CVEs | CVE-2025-49844, CVE-2025-46817, CVE-2025-46818, CVE-2025-46819 |
| Severity | Critical (Redis rates CVE-2025-49844 critical, CVSS 3.1 10.0) |
| Known exploitation | Not in CISA KEV (30 Oct 2026); CISA's record notes a public proof of concept |
What the vulnerabilities are
Debian describes the issues as several flaws in the Lua scripting interface that could result in the execution of arbitrary code or denial of service. All four need a client that is allowed to run Lua scripts with commands such as EVAL:
- CVE-2025-49844: a crafted script can manipulate the garbage collector, trigger a use-after-free and potentially reach remote code execution. Redis's advisory GHSA-4789-qfc9-5f9q rates it critical; the CVE record carries CVSS 3.1 10.0 and NVD scores it 9.9. Valkey's own advisory rates it high.
- CVE-2025-46817 (7.0): an integer overflow in Lua library commands that may lead to code execution.
- CVE-2025-46818 (6.0): a script can manipulate Lua objects and run code in the context of another user.
- CVE-2025-46819 (6.3): an out-of-bounds read that can crash the server.
The word "authenticated" in these records deserves attention. In Redis, the default user has no password unless you set one, and as the Redis ACL documentation explains, new connections are then authenticated as that user automatically. On an instance without a password, anyone who can reach the port counts as authenticated.
Are you affected?
dpkg -l 'redis*' 'valkey*' | grep '^ii'
apt policy redis-server # Debian 12 and 13
apt policy valkey-server # Debian 13Compare the Installed line with the fixed versions above; any later Debian version also includes the fix. Then check who can connect:
sudo ss -ltnp | grep -E 'redis|valkey'
redis-cli ACL LISTA listener on 0.0.0.0 or *, or a user default on nopass line, means the risk is higher than it needs to be.
How to update
sudo apt update
sudo apt upgradeOr update only these packages:
sudo apt install --only-upgrade redis-server redis-tools # Redis
sudo apt install --only-upgrade valkey-server valkey-tools # Valkey on Debian 13Debian 11 (bullseye) received the fix as DLA-4325-1 (5:6.0.16-1+deb11u8), but bullseye's LTS period ended on 31 August 2026, so later Redis fixes do not reach it; upgrade those servers.
Restart or reboot?
No reboot is needed, but the old server process must be replaced. Restart the service and confirm it came back:
sudo systemctl restart redis-server # or: valkey-server
systemctl show -p ActiveEnterTimestamp redis-serverFor instances managed with the template units (redis-server@name or valkey-server@name), restart each one. Plan the restart: unless persistence is configured, data held only in memory is lost.
Reducing exposure
Redis's advisory gives a workaround for servers that cannot be updated at once: stop users from running Lua scripts by restricting the EVAL and FUNCTION command families with ACLs, for example ACL SETUSER appuser -@scripting. Check first whether your application relies on scripts; many queue and locking libraries do. Independently of this issue, bind Redis to localhost or a private network, set a password or ACL users, and block the port at the firewall.
Sources
- security-tracker.debian.org/tracker/DSA-6020-1
- debian.org/security/2025/dsa-6020
- lists.debian.org/debian-security-announce/2025/msg00186.html
- security-tracker.debian.org/tracker/DSA-6022-1
- debian.org/security/2025/dsa-6022
- lists.debian.org/debian-security-announce/2025/msg00188.html
- security-tracker.debian.org/tracker/DLA-4325-1
- lists.debian.org/debian-lts-announce/2025/10/msg00005.html
- github.com/redis/redis/security/advisories/GHSA-4789-qfc9-5f9q
- github.com/redis/redis/security/advisories/GHSA-m8fj-85cg-7vhp
- github.com/valkey-io/valkey/security/advisories/GHSA-9rfg-jx7v-52p6
- cve.org/CVERecord?id=CVE-2025-49844
- nvd.nist.gov/vuln/detail/CVE-2025-49844
- cve.org/CVERecord?id=CVE-2025-46817
- cve.org/CVERecord?id=CVE-2025-46818
- cve.org/CVERecord?id=CVE-2025-46819
- redis.io/docs/latest/operate/oss_and_stack/management/security/acl
- packages.debian.org/source/trixie/valkey
- cisa.gov/known-exploited-vulnerabilities-catalog
Comments
0 total · 0 threads