What’s Vulnerable › Vulnerabilities

CVE-2022-0543: Debian-specific Redis Server Lua Sandbox Escape Vulnerability

• Severity: critical (CVSS 10.0 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2022-03-28
• EPSS: 99.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-02-18 · updated 2026-06-17
• Weakness: CWE-862

Description

It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.

Affected products

• Redis: all versions

References

• http://packetstormsecurity.com/files/166885/Redis-Lua-Sandbox-Escape.html
• https://bugs.debian.org/1005787
• https://lists.debian.org/debian-security-announce/2022/msg00048.html
• https://security.netapp.com/advisory/ntap-20220331-0004/
• https://www.debian.org/security/2022/dsa-5081
• https://www.ubercomp.com/posts/2022-01-20_redis_on_debian_rce
• http://packetstormsecurity.com/files/166885/Redis-Lua-Sandbox-Escape.html
• https://bugs.debian.org/1005787
• https://lists.debian.org/debian-security-announce/2022/msg00048.html
• https://security.netapp.com/advisory/ntap-20220331-0004/
• https://www.debian.org/security/2022/dsa-5081
• https://www.ubercomp.com/posts/2022-01-20_redis_on_debian_rce

Get alerted when CVE-2022-0543 or the next vulnerability affects your stack