CVE-2025-46817

Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to cause an integer overflow and potentially lead to remote code execution The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7 HIGH
LOCAL
HIGH
LOW
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
GitHub_MCNA
7 HIGH
LOCAL
HIGH
LOW
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 96%
VendorProductVersion
redisredis
𝑥
< 6.2.20
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
redict
forky
7.3.6+ds-1
fixed
sid
7.3.6+ds-1
fixed
redis
bullseye
vulnerable
bullseye (security)
5:6.0.16-1+deb11u8
fixed
bookworm
vulnerable
bookworm (security)
5:7.0.15-1~deb12u6
fixed
trixie (security)
5:8.0.2-3+deb13u1
fixed
trixie
5:8.0.2-3+deb13u1
fixed
forky
5:8.0.5-1
fixed
sid
5:8.0.5-1
fixed
valkey
trixie (security)
8.1.1+dfsg1-3+deb13u1
fixed
trixie
8.1.1+dfsg1-3+deb13u1
fixed
forky
8.1.4+dfsg1-1
fixed
sid
8.1.4+dfsg1-1
fixed
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://github.com/redis/redis/commit/fc9abc775e308374f667fdf3e723ef4b7eb0e3ca
https://github.com/redis/redis/releases/tag/8.2.2
https://github.com/redis/redis/security/advisories/GHSA-m8fj-85cg-7vhp