CVE-2024-46981 is a high severity (CVSS 7.0) use after free in Redis Lua scripting. An authenticated user can craft a Lua script that manipulates the garbage collector and potentially reach remote code execution. Fixed releases are 7.4.2, 7.2.7 and 6.2.17. Restricting EVAL and EVALSHA with ACLs is a workaround.
What's affected
The Redis advisory says the problem exists in all versions of Redis with Lua scripting. The fixes are in the 6.2, 7.2 and 7.4 lines.
The NVD record names the fixed releases:
- Redis 7.4.2 for the 7.4 line.
- Redis 7.2.7 for the 7.2 line.
- Redis 6.2.17 for the 6.2 line.
Debian Linux is also listed in the record, and Debian published an LTS announcement for the issue. If you run Redis from a distribution package, check your distribution advisory for the patched package version, because the version string may differ from the upstream numbers.
How to check if you're exposed
Read the server version, then check whether untrusted or low trust users can run Lua scripts.
redis-server --version
redis-cli INFO server | grep redis_version
redis-cli ACL LIST
If the version is below 7.4.2, 7.2.7 or 6.2.17 for its line, it is affected. In ACL LIST, look at which users can call EVAL and EVALSHA. Because exploitation needs an authenticated user, a Redis instance with no network exposure and a tightly held password has a smaller exposure than one shared by many services.
What to do now
- Find every Redis server, including ones inside containers and managed in other teams.
- Upgrade to 7.4.2, 7.2.7 or 6.2.17 depending on your line, or install the patched distribution package.
- Until you can upgrade, use ACLs to deny EVAL and EVALSHA to users that do not need scripting, as the advisory describes.
- Check that your clients do not rely on those commands before you deny them, so you do not break a working application.
- Make sure Redis is not reachable from untrusted networks, and rotate shared passwords if many services use one account.
Why it matters
The weakness is CWE-416 (Use After Free). A use after free happens when memory is released and then used again. Here the Lua engine inside Redis can be pushed into that state by manipulating the garbage collector, and the freed memory can be reused in a way that leads to code execution on the Redis server process.
The CVSS vector lists local attack vector and high complexity, which explains the 7.0 score. The condition that counts is authentication: anyone who can log in and run scripts is a candidate. In shared or multi tenant Redis setups that is a real group. The record does not mark this CVE as exploited, and it is not on the KEV list. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan that you can use to check manifests for known CVEs, and the Gold directory lists this one at https://gold.safeguard.sh/vulnerability/CVE-2024-46981.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Can I avoid patching if I block scripting?
The advisory describes ACL restrictions on EVAL and EVALSHA as an additional workaround, but upgrading is the proper fix.
Was this reported by Redis itself?
The advisory credits p33zy working with Trend Micro Zero Day Initiative.
Sources
Last reviewed: 19 October 2026.
