CVE-2015-4335: Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua bytecode via the...

Security readout for executives and security teams

This flaw affects old Redis releases and could let a remote client abuse Redis scripting to run unsafe Lua bytecode. If an affected Redis server accepts commands from untrusted clients, the business risk is serious because Redis often holds application state, secrets, queues, or operational data. Exposure is most likely on Redis 2.8.20 or earlier, or Redis 3.0.1 or earlier, where untrusted users, applications, or networks can issue Redis commands, especially EVAL. Internally reachable Redis instances still matter if compromised application components can reach them. Treat this as high priority where old Redis is still present. Internet-exposed or broadly reachable Redis should be remediated urgently. If Redis is fully isolated and already upgraded, priority drops to verification and evidence collection. Mitigation focus: Upgrade Redis to 2.8.21, 3.0.2, or a later supported release.; Apply distribution vendor updates from Red Hat, Debian, Fedora, SUSE, or Gentoo where applicable.; Restrict Redis access to trusted application hosts and administrative networks only..

Prepared

Jun 13, 2026, 22:39 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.