CVE-2015-4335

Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua...

10.0 HighFix available

Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua bytecode via the eval command.

Exploit likelihood

9.49%Up 5.7 points since Feb 4, 2022

What each source reports

NVD Score used 10.0

Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua bytecode via the eval command.

Record: CVE-2015-4335
CVSS 2.0: 10.0 HighAV:N/AC:L/Au:N/C:C/I:C/A:C
Weakness: CWE-17
Updated: 2026-11-02

CVE List No score

Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua bytecode via the eval command.

Record: CVE-2015-4335
Updated: 2026-11-02

EUVDEUVD-2015-4358 No score

Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua bytecode via the eval command.

Record: EUVD-2015-4358
Updated: 2026-11-03

GitHub AdvisoriesGHSA-8jrq-fcj6-7g3q No score

Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua...

Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua bytecode via the eval command.

Record: GHSA-8jrq-fcj6-7g3q
Updated: 2026-11-02

OSVBELL-CVE-2015-4335 10.0

CVE-2015-4335 does not affect BellSoft software

Record: BELL-CVE-2015-4335
CVSS 2.0: 10.0 CriticalAV:N/AC:L/Au:N/C:C/I:C/A:C
Updated: 2026-11-02

OSVAZL-44232 No score

CVE-2015-4335 affecting package compat-lua 5.1.5-17

Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua bytecode via the eval command.

Record: AZL-44232
Updated: 2026-11-02

Show 4 moreShow less

OSV No score

Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua bytecode via the eval command.

Record: CVE-2015-4335
Updated: 2026-11-02

OSVDEBIAN-CVE-2015-4335 No score

Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua bytecode via the eval command.

Record: DEBIAN-CVE-2015-4335
Updated: 2026-11-02

OSVMGASA-2015-0244 No score

Updated redis package fixes security vulnerability

It was discovered that redis, a persistent key-value database, could execute insecure Lua bytecode by way of the EVAL command. This could allow remote attackers to break out of the Lua sandbox and execute arbitrary code (CVE-2015-4335).

Record: MGASA-2015-0244
Updated: 2026-11-02

OSVUBUNTU-CVE-2015-4335 No score

Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua bytecode via the eval command.

Record: UBUNTU-CVE-2015-4335
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`compat-lua` Azure Linux:3	through 5.1.5-17	None known
`redis` Debian:12	before 2:3.0.2-1	2:3.0.2-1
`redis` Debian:13	before 2:3.0.2-1	2:3.0.2-1
`redis` Debian:14	before 2:3.0.2-1	2:3.0.2-1
`redis` Debian:8	before 2:2.8.17-1+deb8u1, plus listed versions 2:2.8.17-1	2:2.8.17-1+deb8u1
`redis` Mageia:4	before 2.6.5-4.1.mga4	2.6.5-4.1.mga4
`redis` Red Hat:openstack:6::el7	before 0:2.8.21-1.el7ost	0:2.8.21-1.el7ost
`redis-debuginfo` Red Hat:openstack:6::el7	before 0:2.8.21-1.el7ost	0:2.8.21-1.el7ost
`redis` Ubuntu:14.04:LTS	before 2:2.8.4-2ubuntu0.2, plus listed versions 2:2.6.13-12:2.6.16-32:2.8.0-12:2.8.2-12:2.8.4-2	2:2.8.4-2ubuntu0.2

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-4335 is a high vulnerability (CVSS 10.0) in Redislabs Redis, published June 6, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 9.49%, the 95th percentile. Fixed in redis 2:3.0.2-1.

References

Show 20 moreShow less