CVE-2022-0543: Debian-specific Redis Server Lua Sandbox Escape Vulnerability
Vulnerability summary
CVE-2022-0543 is a critical (CVSS 10.0) Missing Authorization vulnerability in Redis Debian-specific Redis Servers. It is known to be exploited: CISA lists it, first on 28-03-2022. EPSS estimates a 99.35% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 2 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 0 · Related 5Timeline
- 18-02-2022PublishedVulnerability first disclosed.
- 28-03-2022Added to CISA KEVDebian-specific Redis Server Lua Sandbox Escape Vulnerability
- 18-04-2022CISA remediation dueApply updates per vendor instructions.
- 21-10-2025Last modifiedVulnerability information updated.
Description
It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.
CVSS metrics
6 scores · 5 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated10.0CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated10.0CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated10.0CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- NVDNIST10.0CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS trend
Probability
99.35%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
0.00 pp
From 99.35% on 19-09-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 28-03-2022
- Federal due date
- 18-04-2022
CISA required action
Apply updates per vendor instructions. nvd.nist.gov/vuln/detail/CVE-2022-0543
Public exploits
2 foundExploit Reference (packetstormsecurity.com)
Maturity: unknown
Redis Lua Sandbox Escape
exploit/linux/redis/redis_debian_sandbox_escape
Maturity: weaponized
Weaknesses
CWE · root causeAffected systems
Chainguard6 products
- redis-6.2All versions (No fix recorded)
- redis-7.2All versions (No fix recorded)
- redis-7.4< 7.4.7-r0
- redis-8.0< 8.0.5-r0
- redis-8.2< 8.2.3-r0
Debian2 products
- redis< 5:5.0.14-1+deb10u2 | < 5:6.0.16-1+deb11u2 | < 5:6.0.16-2
- redisn/a
Redis1 product
- redisna
Ubuntu1 product
- redis< 5:5.0.7-2ubuntu0.1
4 vendors · 10 products
References
12 links
- lists.debian.org/debian-security-announce/2022/msg00048.htmlMailing ListX Refsource MLISTAdvisoryThird Party Advisory
- www.debian.org/security/2022/dsa-5081Vendor AdvisoryX Refsource DEBIANAdvisoryMailing ListThird Party Advisory
- packetstormsecurity.com/files/166885/Redis-Lua-Sandbox-Escape.htmlX Refsource MISCEVIDENCEExploitThird Party AdvisoryVDB Entry
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-0543Government ResourceWEBUS Government Resource