Every CVE Search/ Get API key

CVE-2022-0543

It was discovered, that redis, a persistent key-value database, due to a packaging issue, is...

10.0 CriticalIn KEVPublic exploitFix available

It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

99.4%Up 94.9 points since Feb 19, 2022
90%50%10%1%

What each source reports

NVD Score used 10.0

It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.

Record
CVE-2022-0543
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS 2.0
10.0 HighAV:N/AC:L/Au:N/C:C/I:C/A:C
Weakness
CWE-862
Updated
2026-11-02
CVE List 10.0

It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.

Record
CVE-2022-0543
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-862
Updated
2026-11-02
EUVDEUVD-2022-15665 10.0

It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.

Record
EUVD-2022-15665
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-9wpj-h5jq-88p9 10.0

It was discovered, that redis, a persistent key-value database, due to a packaging issue, is...

It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.

Record
GHSA-9wpj-h5jq-88p9
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-862
Updated
2026-11-02
CISA KEV No score

Debian-specific Redis Server Lua Sandbox Escape Vulnerability

Redis is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.

Record
CVE-2022-0543
Weakness
CWE-862
Updated
2026-11-02
OSV 10.0

It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.

Record
CVE-2022-0543
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
Show 4 moreShow less
OSVDEBIAN-CVE-2022-0543 10.0

It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.

Record
DEBIAN-CVE-2022-0543
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-03
OSVUBUNTU-CVE-2022-0543 10.0

It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.

Record
UBUNTU-CVE-2022-0543
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVBIT-redis-2022-0543 No score

It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.

Record
BIT-redis-2022-0543
Updated
2026-11-02
OSVUSN-5316-1 No score

redis vulnerability

Reginaldo Silva discovered that due to a packaging issue, a remote attacker with the ability to execute arbitrary Lua scripts could possibly escape the Lua sandbox and execute arbitrary code on the host.

Record
USN-5316-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
redis
Bitnami
 Not stated
Not evaluated
redis
Debian:12
 before 5:6.0.16-2
5:6.0.16-2
redis
Debian:13
 before 5:6.0.16-2
5:6.0.16-2
redis
Debian:14
 before 5:6.0.16-2
5:6.0.16-2
redis
Debian:10
 before 5:5.0.14-1+deb10u2, plus listed versions
5:5.0.14-1+deb10u15:5.0.3-45:5.0.3-4+deb10u15:5.0.3-4+deb10u25:5.0.3-4+deb10u3
Show 15 moreShow less
5:5.0.4-15:5.0.5-15:5.0.5-25:5.0.5-2~bpo10+15:5.0.6-15:5.0.6-1~bpo10+15:5.0.7-15:5.0.7-1~bpo10+15:5.0.7-25:5.0.7-35:5.0.7-45:5.0.7-55:5.0.7-65:5.0.7-75:5.0.7-7~bpo10+1
5:5.0.14-1+deb10u2
redis
Debian:11
 before 5:6.0.16-1+deb11u2, plus listed versions
5:6.0.15-15:6.0.16-15:6.0.16-1+deb11u15:6.0.16-1~bpo10+15:6.0.16-1~bpo11+1
5:6.0.16-1+deb11u2
redis
Ubuntu:20.04:LTS
 before 5:5.0.7-2ubuntu0.1, plus listed versions
5:5.0.5-2build15:5.0.6-15:5.0.7-15:5.0.7-2
5:5.0.7-2ubuntu0.1

Not evaluated means the source gave git commits or a range we can't read, so we can't tell which releases are affected. A fixed version beside it is the source’s own claim.

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
MetasploitRedis Lua Sandbox Escape2022-02-18
PoC in GitHub0x7eTeam/CVE-2022-05432022-03-16
PoC in GitHubz92g/CVE-2022-05432022-07-06
PoC in GitHubfulxey/CVE-2022-05432022-09-05
PoC in GitHubSiennaSkies/redisHack2023-05-10
PoC in GitHubnetw0rk7/CVE-2022-0543-Home-Lab2025-11-18
PoC in GitHubCyberCTF/vulhub-redis-cve-2022-05432026-10-08
NucleiRedis Sandbox Escape - Remote Code Execution

History

History
RecordedChangedSources
exploitationOSV
exploitsOSV
first indexedCVE List, EUVD, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-0543 is a critical vulnerability (CVSS 10.0) in Debian Redis, published February 18, 2022. CISA lists it as known to be exploited, since March 28, 2022. EUVD reports exploitation since March 28, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 99.4%, the 99th percentile. Fixed in redis 5:6.0.16-2.

References

Show 8 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open