CVE-2025-46817 HIGH

Published: 2025-10-03 | Last Modified: 2026-01-27 | Status: Analyzed

Description

Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to cause an integer overflow and potentially lead to remote code execution The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2.

CVSS Metrics

Base Score: 8.8 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector	NETWORK
Attack Complexity	LOW
Privileges Required	LOW
User Interaction	NONE
Scope	UNCHANGED
Confidentiality Impact	HIGH
Integrity Impact	HIGH
Availability Impact	HIGH

Source: [email protected]

Type: Primary

Exploitability Score: 2.8

Impact Score: 5.9

Weaknesses

Source	Type	Description
[email protected]	Secondary	en CWE-190

Affected Products

Vendor	Product	Version	Update	Type
redis	redis	*	<built-in method update of dict object at 0x7e61084063c0>	Application
redis	redis	*	<built-in method update of dict object at 0x7e6108405180>	Application
redis	redis	*	<built-in method update of dict object at 0x7e6112c85900>	Application
redis	redis	*	<built-in method update of dict object at 0x7e60e8c7ef00>	Application
redis	redis	*	<built-in method update of dict object at 0x7e6108406a00>	Application

Affected Configurations

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:a:redis:redis::::::::`
Yes	`cpe:2.3:a:redis:redis::::::::`
Yes	`cpe:2.3:a:redis:redis::::::::`
Yes	`cpe:2.3:a:redis:redis::::::::`
Yes	`cpe:2.3:a:redis:redis::::::::`

References

https://github.com/redis/redis/commit/fc9abc775e308374f667fdf3e723ef4b7eb0e3ca
Source: [email protected]

Patch
https://github.com/redis/redis/releases/tag/8.2.2
Source: [email protected]

Release Notes
https://github.com/redis/redis/security/advisories/GHSA-m8fj-85cg-7vhp
Source: [email protected]

Vendor Advisory