Vuln: CVE-2025-49844 | Detection.FYI

Potential Redis Lua Use-After-Free RCE Attempt (CVE-2025-49844 / RediShell)

Sep 19, 2026 · Domain: Network Use Case: Threat Detection Use Case: Vulnerability Tactic: Initial Access Tactic: Execution Data Source: Network Packet Capture Resources: Investigation Guide Noise: Unknown Performance: Fast Profile: Recommended Threat: Vulnerability Exploit Rule Type: Event Correlation (EQL) Vuln: CVE-2025-49844 ·
Share on:

This rule detects exploitation attempts targeting CVE-2025-49844 (RediShell), a CVSS 10.0 use-after-free vulnerability in the Redis Lua interpreter. An authenticated attacker sends an EVAL command containing a Lua script that calls string.rep() to create memory pressure and collectgarbage('collect') to force garbage collection, exploiting a use-after-free in the Lua parser to achieve remote code execution.

Read More