Skip to main content

Redis CVE-2025-46819

| EUVDEUVD-2025-33200 HIGH
Integer Overflow or Wraparound (CWE-190)
2025-10-03 security-advisories@github.com
Denial Of Service Integer Overflow Redis
7.1
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Authenticate to Redis with scripting-capable ACL
  2. Delivery
    Submit crafted Lua script via EVAL
  3. Exploit
    Trigger integer overflow in lexer skip_sep
  4. Execution
    Out-of-bounds read leaks memory or crashes server
  5. Impact
    Denial of service for all clients

Vulnerability Assessment

Weakness
CWE
CWE-190
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires (1) an authenticated Redis session (PR:L) whose ACL permits Lua script execution - specifically access to the EVAL and/or FUNCTION command families - and (2) Redis versions 8.2.1 or below with Lua scripting enabled (the default). The exact trigger is a crafted Lua script with a malformed long-string delimiter (e.g., '[=...=[' bracket sequences) processed by the lexer. The documented mitigating control is to block scripting via ACL by restricting both the EVAL and FUNCTION command families, which fully prevents exploitation without patching. Limiting factors: an attacker must already possess a credential with scripting rights, so instances that disable scripting or restrict it via ACL are not exploitable; there is no path for an unauthenticated or non-scripting user.
Impact

This is a moderate-priority issue rather than a critical fire-drill, and the signals are internally consistent once the authentication barrier is understood. The official CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H = 7.1) requires an already-authenticated user with privileges to run Lua scripts, which materially lowers real-world risk compared to an unauthenticated flaw. The EPSS score of 5.05% sits at the 90th percentile - elevated relative to the average CVE, reflecting that public exploit code exists and the product is prominent, but still far from the high-probability tier. POC availability is confirmed, but this is NOT the same as active exploitation: the input provides no CISA KEV listing, so this is best treated as 'exploitable in principle' rather than 'being exploited now.' No SSVC decision data was supplied in the input. One notable conflict to flag: the CVSS vector declares AV:L (local), yet Redis is fundamentally a network-accessible service and the malicious EVAL/FUNCTION Lua payload is delivered over the client protocol - so an attacker with network reachability and a credential/ACL permitting scripting can trigger this remotely; verify the AV:L assignment with the vendor/NVD, as it understates the delivery path. The dominant impact is denial of service (server crash) plus out-of-bounds memory disclosure (C:H), with no integrity impact.
Exploit ScenarioDerived

An attacker who already holds a valid Redis credential (or exploits an exposed/weakly-authenticated instance) with permission to run scripts submits a specially crafted Lua script via EVAL containing a malformed long-string bracket sequence, triggering an integer-handling flaw in the Lua lexer's skip_sep routine. This causes an out-of-bounds read that either leaks adjacent process memory or crashes redis-server, denying service to all clients. Publicly available exploit code exists, and the low attack complexity (AC:L) means the crafted script is reliably reproducible.
Act Now Prioritize within 24-48h. Why: Active threat signals + CRITICAL/HIGH severity.
Patch available 5.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv2 – Oct 19, 2026

Authenticated Lua script execution in Redis 8.2.1 and earlier can be abused with a crafted long-string delimiter to trigger an out-of-bounds read or crash the server, yielding high confidentiality impact and denial of service. The flaw affects all Redis releases that support Lua scripting, which is enabled by default, but requires a credential whose ACL permits the EVAL and/or FUNCTION command families. Publicly available exploit code exists and the EPSS score is 5.05% (90th percentile), indicating elevated attention, but there is no confirmed active exploitation in CISA KEV; the authentication and scripting-permission barrier keeps this a moderate-priority issue rather than a critical one.

Earlier versions of this analysis (1)
v1 Mar 13, 2026 - 19:29 CVSS 6.3

RemediationAI

Upgrade to Redis 8.2.2 or later; this is the vendor-released patch and incorporates commit 3a1624da2449ac3dbfc4bdaed43adf77a0b7bfba, which corrects the integer handling in the Lua lexer. Operators using distribution packages should apply the corresponding updates from Ubuntu (USN-7893-1), Debian (DSA-6020-1, DSA-6022-1, DLA-4325-1), or Red Hat (RHSA-2025:19237 and related errata) rather than building from upstream. If patching must be deferred, the documented workaround is to prevent Lua script execution using ACLs: restrict both the EVAL and FUNCTION command families, which in practice means denying EVAL, EVALSHA, EVAL_RO, EVALSHA_RO, FCALL, FCALL_RO, FUNCTION, and SCRIPT for untrusted users. This fully blocks the trigger but breaks legitimate applications that rely on Lua scripting or Redis Functions, so it should be scoped to users who do not need those capabilities and tested in staging before rollout. Additional defense in depth includes requiring strong authentication, avoiding internet exposure of Redis, and limiting which users hold the scripting permissions; none of those controls replaces the patch. Advisory references: https://github.com/redis/redis/security/advisories/GHSA-4c68-q8q8-3g4f and https://github.com/redis/redis/releases/tag/8.2.2.

Affected VersionsENISA

Redis < 8.2.2

Affected Packages

euvd redis fix: 8.2.2

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Redis embeds a Lua 5.1 interpreter, and the vulnerable component is the Lua lexer in deps/lua/src/llex.c. The root cause is CWE-190 integer overflow in the long-string delimiter handling: skip_sep counts the '=' characters in a sequence such as '[===[', stores the count in an int, and returns an encoded value that distinguishes well-formed delimiters from unfinished or malformed ones. An extremely long delimiter sequence can overflow the count and cause the returned separator length to be misinterpreted. read_long_string then uses that separator value to compute buffer offsets for luaX_newstring, producing an out-of-bounds read or an invalid memory access that crashes redis-server. The upstream fix changes skip_sep to return size_t with a new return convention (count + 2 for well-formed, 1 for no '=', and 0 for an unfinished sequence), changes read_long_string to accept a size_t separator, and adjusts the buffer offset calculation accordingly. Regression tests were added for long escape sequences and for Lua parsing strings with too many new lines, exercising the same lexer path. The issue affects every Redis build with Lua scripting, not only version 8.2.1, but is fixed in 8.2.2.

Know when Redis gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
vuln.today AI 8.1 HIGH

Payload is delivered over Redis's network protocol so AV:N (diverging from the input's AV:L); PR:L for required authenticated scripting rights; C:H/A:H for OOB read and crash, I:N as no integrity impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
Ubuntu MEDIUM
SUSE 6.3 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H
Red Hat 6.3 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

5
Severity Changed
Oct 19, 2026 - 17:23 NVD
MEDIUM HIGH
CVSS changed
Oct 19, 2026 - 17:23 NVD
6.3 (MEDIUM) 7.1 (HIGH)
Patch released
Jan 27, 2026 - 19:37 nvd
Patch available
CVE Published
Oct 03, 2025 - 19:15 nvd
HIGH 7.1
CVE Published
Oct 03, 2025 - 19:15 nvd
MEDIUM 6.3

DescriptionNVD

Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted LUA script to read out-of-bound data or crash the server and subsequent denial of service. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to block a script by restricting both the EVAL and FUNCTION command families.

Executive ViewAI

Why It Matters

Organizations using Redis should be aware of moderate risk from CVE-2025-46819, a integer overflow vulnerability rated CVSS 6.3. Exploitation could cause memory corruption or application crashes. A patch is available and should be applied during regular vulnerability management.

Business Impact: Low
Compensating Controls

Apply vendor patch. If patching is delayed: enable ASLR/DEP, apply network segmentation.

Threat Intelligence Overview

Threat Score
5.1/10
Composite threat intelligence
EPSS Score
5.0%
Top 10% exploitable
Prevalence
High
Redis is a core caching/datastore in a vast share of web and cloud stacks
Threat Intel
1
1 sources
Exploit
POC
Public exploit code exists
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS CISA POC (1) Vendor GitHub Nuclei

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC Yes
EPSS 5.0%
Patch available Yes
Active threat Yes
Deciding rule
Active threat signals + CRITICAL/HIGH severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
Poc
System Exposure· derived
Small
Automatable· derived
No
Human Impact
Low

Priority Score

71
Low Medium High Critical
KEV: 0
EPSS: +5
CVSS: +36
PoC: +20
Weaponized: 0
Threat intel: +10
Gov advisory: 0

Attack Technique

Integer Overflow MEDIUM

Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Redis

View all
CVE-2026-48172 CRITICAL POC
10.0 May 21

Privilege escalation to root in the LiteSpeed User-End cPanel Plugin (versions 2.3 through before 2.4.5) lets attackers

CVE-2025-49844 CRITICAL POC
9.9 Oct 03

UAF in Redis 8.2.1 via crafted Lua scripts by authenticated users. EPSS 12.4%. Patch available.
CVE-2025-46817 HIGH POC
8.8 Oct 03

Authenticated Redis users with permission to run server-side Lua can trigger an integer overflow (CWE-190) in the bundle
CVE-2022-0543 CRITICAL POC
10.0 Feb 18

It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific
CVE-2018-11218 CRITICAL POC
9.8 Jun 17

Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10,
CVE-2015-4335 CRITICAL POC
10.0 Jun 09

Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua bytecode via the eval command.
CVE-2016-8339 CRITICAL POC
9.8 Oct 28

A buffer overflow in Redis 3.2.x prior to 3.2.4 causes arbitrary code execution when a crafted command is sent. Rated cr
CVE-2026-77602 CRITICAL POC
9.9 Sep 23

Authenticated remote code execution in OpenC3 COSMOS (Ruby gem 'openc3' versions 5.1.0 through 7.2.1) lets any logged-in
CVE-2025-46818 HIGH POC
7.3 Oct 03

CVE-2025-46818 is a sandbox-escape flaw in Redis's embedded Lua scripting engine (all versions up to and including 8.2.1
CVE-2026-27574 CRITICAL POC
9.9 Feb 21

Code injection in OneUptime monitoring via custom JS monitor using vm module. PoC and patch available.
CVE-2026-84372 CRITICAL POC
9.8 Sep 01

RESP protocol command injection in Predis, the popular PHP client for Redis and Valkey, affects versions 3.0.0-RC1 throu
CVE-2021-31649 CRITICAL POC
9.8 Jun 24

In applications using jfinal 4.9.08 and below, there is a deserialization vulnerability when using redis,may be vulnerab

Same weakness CWE-190 – Integer Overflow or Wraparound

View all
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2023-21716 CRITICAL POC
9.8
CVE-2017-3599 HIGH POC
7.5
CVE-2026-97229 CRITICAL POC
10.0
CVE-2017-7529 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

Ubuntu

Priority: Medium
redict
Release Status Version
jammy DNE -
noble DNE -
upstream needs-triage -
plucky ignored end of life, was needs-triage
questing needs-triage -
valkey
Release Status Version
jammy DNE -
upstream needs-triage -
noble released 7.2.11+dfsg1-0ubuntu0.2
plucky released 8.0.6+dfsg1-0ubuntu0.2
questing released 8.1.4+dfsg1-0ubuntu0.2
redis
Release Status Version
bionic needed -
focal needed -
jammy needed -
noble needed -
trusty needed -
upstream released 8.2.2
xenial needed -
plucky ignored end of life, was needed
questing needed -
USN-7893-1

Debian

Bug #1117690
redict
Release Status Fixed Version Urgency
forky, sid fixed 7.3.6+ds-1 -
(unstable) fixed 7.3.6+ds-1 -
redis
Release Status Fixed Version Urgency
bullseye fixed 5:6.0.16-1+deb11u8 -
bullseye (security) fixed 5:6.0.16-1+deb11u8 -
bookworm, bookworm (security) fixed 5:7.0.15-1~deb12u6 -
trixie (security), trixie fixed 5:8.0.2-3+deb13u1 -
forky, sid fixed 5:8.0.5-1 -
bookworm fixed 5:7.0.15-1~deb12u6 -
trixie fixed 5:8.0.2-3+deb13u1 -
(unstable) fixed 5:8.0.4-1 -
valkey
Release Status Fixed Version Urgency
trixie (security), trixie fixed 8.1.1+dfsg1-3+deb13u1 -
forky, sid fixed 8.1.4+dfsg1-1 -
trixie fixed 8.1.1+dfsg1-3+deb13u1 -
(unstable) fixed 8.1.4+dfsg1-1 -
DLA-4325-1 DSA-6020-1 DSA-6022-1

SUSE

Severity: Medium
Product Status
Image SL-Micro-Azure Image SL-Micro-BYOS-Azure Image SL-Micro-BYOS-EC2 Image SL-Micro-BYOS-GCE Image SL-Micro-EC2 Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-Azure-llc Image SUSE-Multi-Linux-Manager-Server-Azure-ltd Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd Affected
SUSE Enterprise Storage 7.1 Fixed
SUSE Liberty Linux 8 Fixed
SUSE Liberty Linux 9 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS Fixed

Threat IntelligenceMISP

CISA Advisories
ICSA-26-083-03
Sources: CISA (public domain), Metasploit/Nuclei

References

Advisories & patches
PATCH https://github.com/redis/redis/commit/3a1624da2449ac3dbfc4bdaed43adf77a0b7bfba ADVISORY https://access.redhat.com/errata/RHSA-2025:19237 ADVISORY https://access.redhat.com/errata/RHSA-2025:19238 ADVISORY https://access.redhat.com/errata/RHSA-2025:19345 ADVISORY https://access.redhat.com/errata/RHSA-2025:19675 ADVISORY https://access.redhat.com/errata/RHSA-2025:20926 ADVISORY https://access.redhat.com/errata/RHSA-2025:20955 ADVISORY https://access.redhat.com/errata/RHSA-2025:21916 ADVISORY https://access.redhat.com/errata/RHSA-2025:21936 ADVISORY https://security-tracker.debian.org/tracker/dla-4325-1 ADVISORY https://security-tracker.debian.org/tracker/dsa-6020-1 ADVISORY https://security-tracker.debian.org/tracker/dsa-6022-1 ADVISORY https://ubuntu.com/security/notices/USN-7893-1 ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:03499/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:03500/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:03501/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:03502/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:03505/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:03506/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:03507/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20022/ REF https://github.com/redis/redis/releases/tag/8.2.2 REF https://github.com/redis/redis/security/advisories/GHSA-4c68-q8q8-3g4f REF https://www.vicarius.io/vsociety/posts/cve-2025-46819-detect-redis-vulnerability REF https://www.vicarius.io/vsociety/posts/cve-2025-46819-mitigate-redis-vulnerability

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy