CVE-2022-0543

Debian-specific Redis Server Lua Sandbox Escape Vulnerability

Published Feb 18, 2022 · updated Jun 16, 2026 · redis redis

It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.

Timeline

Detection, updates, and resolution for this record.

Feb 18, 2022 · Catalog
Detected
It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.
Mar 28, 2022 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Apr 18, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.

Required action

Apply updates per vendor instructions.

CISA due date Apr 18, 2022

Affected

cpe redis/redisversion unspecified
vendor Redis Debian-specific Redis Serversversion unspecified

Sources

CISA KEVCVE-2022-0543
Redis is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.
cisa.gov
CVE.orgCVE-2022-0543
Official CVE identifier
cve.org
FIRST EPSSCVE-2022-0543
30-day exploitation probability 99.4%
first.org
Metasploit Modulesexploit_linux/redis/redis_debian_sandbox_escape
Public module reference (excellent). Module source is not copied into this catalog.
rapid7.com
NIST NVDCVE-2022-0543
It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.
nvd.nist.gov
Packet Storm Securityhttp://packetstormsecurity.com/files/166885/Redis-Lua-Sandbox-Escape.html
Packet Storm link already published on the finding.
packetstormsecurity.com