critical CVSS 10 Actively exploited EPSS 99%

CVE-2022-0543·Redis vulnerability

It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.

Severity
critical
Software
Redis
Fixed in
5:6.0.16-2
Published

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 99% — among the highest-scoring CVEs ever published. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Affected versions

Until: 5:6.0.16-2

Fixed in: 5:6.0.16-2

How to fix this CVE

Upgrade Redis to version 5:6.0.16-2 or later to patch a Lua sandbox escape vulnerability in Debian-packaged versions that allows unauthenticated remote code execution. This critical issue affects the Lua scripting engine used by Redis and requires immediate patching on all exposed instances. Verify the upgrade completion and restart the Redis service to ensure the fix is active.

sudo dnf update redis -y && sudo systemctl restart redis

Defensia detects this vulnerability

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

(?:redis-cli|nc|telnet).*EVAL.*(?:os\.execute|io\.open|loadfile|require).*(?:bash|sh|cmd|powershell)|redis.*SCRIPT LOAD.*sandbox

How to check if you are affected

  1. Check installed Redis version: redis-cli INFO server | grep redis_version or redis-server --version
  2. Verify if Redis is listening on network interfaces: sudo netstat -tlnp | grep redis or sudo ss -tlnp | grep redis
  3. Search Redis logs for Lua script execution attempts: sudo grep -i 'EVAL\|EVALSHA' /var/log/redis/redis-server.log
  4. Confirm patched version is running: redis-cli INFO server and verify version is 6.0.16-2 or higher with dpkg -l | grep redis

FAQ

What is CVE-2022-0543?

This is a critical vulnerability in Debian-packaged Redis versions where a flaw in the Lua sandboxing mechanism allows attackers to escape the restricted Lua environment and execute arbitrary system commands on the host without authentication.

Is CVE-2022-0543 being actively exploited?

Yes, this vulnerability is actively exploited in the wild and is tracked in the CISA Known Exploited Vulnerabilities (KEV) catalog, making it a high-priority target for threat actors.

What versions of Redis are affected by CVE-2022-0543?

Redis versions up to and including 5:6.0.16-1 (Debian packaging) are vulnerable. The vulnerability was patched in version 5:6.0.16-2 and later.

How do I check if my server is vulnerable to CVE-2022-0543?

Run 'redis-cli INFO server' and check the redis_version field. If it shows a version earlier than 6.0.16-2 on a Debian-based system, your instance is vulnerable. Cross-reference with 'dpkg -l | grep redis-server' to confirm the exact package version.

Does Defensia detect CVE-2022-0543?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If Redis is installed on a monitored server, CVE-2022-0543 will appear in your dashboard with remediation steps.

Related Redis CVEs

CVE-2026-23479CVSS 8.8Redis is an in-memory data structure store. In redis-server from 7.2.0 until 8.6.3, the unblock client flow does not handle an error return from `processCommandAndResetClient` when re-executing a blocked command. If a blocked client is evicted during this flow, an authenticated attacker can trigger a use-after-free that may lead to remote code execution. This has been patched in version 8.6.3.
CVE-2026-25243CVSS 8.8Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This is patched in version 8.6.3.
CVE-2018-12326CVSS 8.5Buffer overflow in redis-cli of Redis before 4.0.10 and 5.x before 5.0 RC3 allows an attacker to achieve code execution and escalate to higher privileges via a crafted command line. NOTE: It is unclear whether there are any common situations in which redis-cli is used with, for example, a -h (aka hostname) argument from an untrusted source.
CVE-2026-66373CVSS 8.5Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer, because deleting both consumers via XGROUP DELCONSUMER leads to a double free. NOTE: this issue exists because of an incomplete fix for CVE-2026-25243.
CVE-2026-23631CVSS 8.1Redis is an in-memory data structure store. In all versions of redis-server with Lua scripting, an authenticated attacker can exploit the master-replica synchronization mechanism to trigger a use-after-free on replicas where replica-read-only is disabled or can be disabled, which may lead to remote code execution. A workaround is to prevent users from executing Lua scripts or avoid using replicas where replica-read-only is disabled. This is patched in version 8.6.3.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2022-0543. Free for 1 server.

Get started free