CVE-2024-46981: Redis' Lua library commands may lead to remote code execution
Last updated 20 March 2025
Other sources
Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to manipulate the garbage collector and potentially lead to remote code execution. The problem is fixed in 7.4.2, 7.2.7, and 6.2.17. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.
— MITRE
Redis' Lua library commands may lead to remote code execution
— Microsoft
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/redictto a version that resolves this vulnerability.Fixed in 7.3.2+ds-1 - Upgrade
Upgrade
debian/redisto a version that resolves this vulnerability.Fixed in 5:6.0.16-1+deb11u5Fixed in 5:7.0.15-1~deb12u3Fixed in 5:7.0.15-3 - Upgrade
Upgrade
debian/valkeyto a version that resolves this vulnerability.Fixed in 8.0.2+dfsg1-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.0.2-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.2.17-1 - Upgrade
Upgrade
Redisto a version that resolves this vulnerability.Fixed in 7.4.2 - Upgrade
Upgrade
Redisto a version that resolves this vulnerability.Fixed in 7.2.7 - Upgrade
Upgrade
Redisto a version that resolves this vulnerability.Fixed in 6.2.17 - Configuration
Use Redis ACL to restrict EVAL and EVALSHA commands so users cannot execute Lua scripts.
Redis ACL Restrict EVAL and EVALSHA = deny
Event History
Frequently Asked Questions
What is the severity of CVE-2024-46981?
CVE-2024-46981 is classified as a high-severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2024-46981?
To fix CVE-2024-46981, upgrade your Redis installation to version 7.4.2, 7.2.7, or 6.2.17.
What versions of Redis are affected by CVE-2024-46981?
CVE-2024-46981 affects all Redis versions prior to 7.4.2, 7.2.7, and 6.2.17.
Can an attacker exploit CVE-2024-46981 without authentication?
No, an attacker must be an authenticated user to exploit CVE-2024-46981.
What type of vulnerability is identified by CVE-2024-46981?
CVE-2024-46981 is a code execution vulnerability that arises from improper handling of the Lua scripting functionality in Redis.