Critical Redis Vulnerability (CVE-2025-49844)

Overview

Redis has released a critical security update to patch a newly discovered vulnerability (CVE-2025-49844) that poses a serious threat to servers running affected Redis versions.
This flaw has been assigned a CVSS v3.1 score of 9.9 out of 10, marking it as one of the most severe vulnerabilities in recent Redis releases.

Impact

An authenticated attacker could exploit this vulnerability by uploading a maliciously crafted script, potentially leading to remote code execution (RCE) on the Redis host.
Successful exploitation may result in unauthorized access, data compromise, or even a complete system takeover.

Affected Versions

The following Redis versions are affected:

• Redis Software prior to:

  • 7.22.2-12

  • 7.8.6-207

  • 7.4.6-272

  • 7.2.4-138

  • 6.4.2-131

• Redis OSS / Community Edition prior to:

  • 8.2.2

  • 8.0.4

  • 7.4.6

  • 7.2.11

• Redis Stack prior to:

  • 7.4.0-v7

  • 7.2.0-v19

Mitigation and Best Practices

Redis users and administrators are strongly advised to update immediately to the latest patched version.
If upgrading is not possible, apply the following precautions:

• Restrict Redis access to trusted internal networks only.

• Disable or monitor script uploads carefully.

• Review system and Redis logs for unusual activities.

How QUAPE Protects Our Customers

At QUAPE, security is our top priority.
To mitigate risks from external exploitation, all external Redis ports are blocked by default on our hosting infrastructure.
Redis services are only accessible via secured internal networks or through authenticated connections, significantly reducing exposure to potential attacks.

We have also verified that all Redis instances managed by QUAPE are patched and not affected by this vulnerability.

For clients operating their own Redis servers, we strongly recommend applying the latest updates immediately.
If you require assistance verifying your environment’s security, our technical team is available to help.

📘 Reference:
https://redis.io/blog/security-advisory-cve-2025-49844/