ESB-2026.3653 — Vulnetix

ESB-2026.3653 PUBLISHED CVSS 9.899999618530273 CRITICAL

=========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2026.3653 USN-8169-1: Redis, Lua vulnerabilities 15 April 2026 =========================================================================== AUSCERT Security Bulletin Summary --------------------------------- Product: Lua Redis Publisher: Ubuntu Operating System: Ubuntu Resolution: Patch/Upgrade CVE Names: CVE-2024-31449 CVE-2025-49844 CVE-2022-24834 Original Bulletin: https://ubuntu.com/security/notices/USN-8169-1 Comment: CVSS (Max): 9.9 CVE-2025-49844 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) CVSS Source: Ubuntu Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H EPSS (Max): 61.3% (98th) CVE-2024-31449 2026-04-13 - --------------------------BEGIN INCLUDED TEXT-------------------- USN-8169-1: Redis, Lua vulnerabilities Publication date 13 April 2026 Overview Several security issues were fixed in Redis, lua5.1, lua-cjson, lua-bitop. Releases 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS --------------------------------------------------------------------------------- Open side navigation Packages o lua-bitop - fast bit manipulation library for the Lua language o lua-cjson - JSON parser/encoder for Lua language o lua5.1 - Lua is an embeddable scripting language o redis - Persistent key-value database with network interface Details It was discovered that Redis incorrectly handled certain specially crafted Lua scripts. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue was only addressed in lua5.1 on Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. ( CVE-2025-49844 ) It was discovered that Redis incorrectly handled certain specially crafted Lua scripts. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue was only addressed in lua-bitop on Ubuntu 20.04 LTS and Ubuntu 22.04 LTS and in redis on Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 24.04 LTS. ( CVE-2024-31449 ) Seiya Nakata and Yudai Fujiwara discovered that Redis incorrectly handled certain specially crafted Lua scripts. An attacker could possibly use this issue to cause heap corruption and execute arbitrary code. This issue was only addressed in lua-cjson on Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. ( CVE-2022-24834 ) --------------------------------------------------------------------------------- Update instructions The problem can be corrected by updating your system to the following package versions: Ubuntu Package Version Release 24.04 redis - 5:7.0.15-1ubuntu0.24.04.4 LTS redis-sentinel - 5:7.0.15-1ubuntu0.24.04.4 noble redis-server - 5:7.0.15-1ubuntu0.24.04.4 redis-tools - 5:7.0.15-1ubuntu0.24.04.4 liblua5.1-0 - 5.1.5-8.1ubuntu0.22.04.1~esm1 Ubuntu Pro Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future. liblua5.1-0-dev - 5.1.5-8.1ubuntu0.22.04.1~esm1 Ubuntu Pro Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future. liblua5.1-bitop-dev - 1.0.2-5ubuntu0.22.04.1~esm2 Ubuntu Pro Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future. liblua5.1-bitop0 - 1.0.2-5ubuntu0.22.04.1~esm2 Ubuntu Pro Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future. 22.04 lua-bitop - 1.0.2-5ubuntu0.22.04.1~esm2 Ubuntu Pro Fix available with LTS Ubuntu Pro via ESM Apps. A community fix might become publicly jammy available in the future. lua-bitop-dev - 1.0.2-5ubuntu0.22.04.1~esm2 Ubuntu Pro Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future. lua-cjson - 2.1.0+dfsg-2.1ubuntu0.22.04.1~esm2 Ubuntu Pro Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future. lua-cjson-dev - 2.1.0+dfsg-2.1ubuntu0.22.04.1~esm2 Ubuntu Pro Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future. lua5.1 - 5.1.5-8.1ubuntu0.22.04.1~esm1 Ubuntu Pro Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future. liblua5.1-0 - 5.1.5-8.1ubuntu0.20.04.1~esm1 Ubuntu Pro Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future. liblua5.1-0-dev - 5.1.5-8.1ubuntu0.20.04.1~esm1 Ubuntu Pro Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future. liblua5.1-bitop-dev - 1.0.2-5ubuntu0.20.04.1~esm2 Ubuntu Pro Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future. liblua5.1-bitop0 - 1.0.2-5ubuntu0.20.04.1~esm2 Ubuntu Pro Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future. 20.04 lua-bitop - 1.0.2-5ubuntu0.20.04.1~esm2 Ubuntu Pro Fix available with LTS Ubuntu Pro via ESM Apps. A community fix might become publicly focal available in the future. lua-bitop-dev - 1.0.2-5ubuntu0.20.04.1~esm2 Ubuntu Pro Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future. lua-cjson - 2.1.0+dfsg-2.1ubuntu0.20.04.1~esm2 Ubuntu Pro Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future. lua-cjson-dev - 2.1.0+dfsg-2.1ubuntu0.20.04.1~esm2 Ubuntu Pro Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future. lua5.1 - 5.1.5-8.1ubuntu0.20.04.1~esm1 Ubuntu Pro Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future. redis - 5:4.0.9-1ubuntu0.2+esm7 Ubuntu Pro Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future. redis-sentinel - 5:4.0.9-1ubuntu0.2+esm7 Ubuntu Pro Fix available 18.04 with Ubuntu Pro via ESM Apps. A community fix might become publicly LTS available in the future. bionic redis-server - 5:4.0.9-1ubuntu0.2+esm7 Ubuntu Pro Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future. redis-tools - 5:4.0.9-1ubuntu0.2+esm7 Ubuntu Pro Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future. redis-sentinel - 2:3.0.6-1ubuntu0.4+esm5 Ubuntu Pro Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future. 16.04 redis-server - 2:3.0.6-1ubuntu0.4+esm5 Ubuntu Pro Fix available with LTS Ubuntu Pro via ESM Apps. A community fix might become publicly xenial available in the future. redis-tools - 2:3.0.6-1ubuntu0.4+esm5 Ubuntu Pro Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future. --------------------------------------------------------------------------------- References o CVE-2025-49844 o CVE-2024-31449 o CVE-2022-24834 Related notices o USN-7893-1 o USN-7824-1 o USN-7824-2 o USN-7824-3 o USN-6531-1 - --------------------------END INCLUDED TEXT---------------------- You have received this e-mail bulletin as a result of your organisation's registration with AUSCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AUSCERT's members. As AUSCERT did not write the document quoted above, AUSCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AUSCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://portal.auscert.org.au/bulletins/ =========================================================================== AUSCERT The University of Queensland, Brisbane QLD 4072 Australia e: auscert@auscert.org.au t: +61 (0)7 3365 4417 Allies in Cyber Security ===========================================================================

Risk Scores

CVSS v3.1

9.899999618530273

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions
Ubuntu	Lua

Timeline

Apr 15, 2026 CVE Published
Apr 15, 2026 Distribution Patch

References

Open in Interactive Console →