CVE-2025-46819: redis Integer Overflow — Fix

Description

Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted LUA script to read out-of-bound data or crash the server and subsequent denial of service. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to block a script by restricting both the EVAL and FUNCTION command families.

Is your site exposed to CVE-2025-46819?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

6.3

MEDIUM

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H

Weakness Type (CWE)

CWE-190 Integer Overflow

CWE-125 Out-of-bounds Read

Affected Products

Vendor	Product	Versions
redis	redis	< 6.2.20
redis	redis	7.0 — 7.2.11
redis	redis	7.4.0 — 7.4.6
redis	redis	8.0.0 — 8.0.4
redis	redis	8.2.0 — 8.2.2

References

Advisories & Patches

https://github.com/redis/redis/commit/3a1624da2449ac3dbfc4bdaed43adf77a0b7bfba

Other References

https://github.com/redis/redis/releases/tag/8.2.2 https://github.com/redis/redis/security/advisories/GHSA-4c68-q8q8-3g4f https://www.vicarius.io/vsociety/posts/cve-2025-46819-detect-redis-vulnerability https://www.vicarius.io/vsociety/posts/cve-2025-46819-mitigate-redis-vulnerability

Frequently Asked Questions

What is CVE-2025-46819? +

Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted LUA script to read out-of-bound data or crash the server and subsequent denial of service. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to block a script by restricting both the EVAL and FUNCTION command families. It has a CVSS v3.1 base score of 6.3 (MEDIUM).

How severe is CVE-2025-46819? +

CVE-2025-46819 has a CVSS v3.1 score of 6.3 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2025-46819? +

CVE-2025-46819 affects products from redis, specifically: redis. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-46819? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-16280

An integer overflow when calculating physical offsets for sparse PMRs may result in 32-bit truncation of address computations for PMRs …

CVE-2025-2574

Out-of-bounds array write in Xpdf 4.05 and earlier, due to incorrect integer overflow checking in the PostScript function interpreter code.

CVE-2025-46333

z2d is a pure Zig 2D graphics library. Versions of z2d after `0.5.1` and up to and including `0.6.0`, when …

CVE-2024-30212

If a SCSI READ(10) command is initiated via USB using the largest LBA (0xFFFFFFFF) with it's default block size of …

CVE-2025-52935

Integer Overflow or Wraparound vulnerability in dragonflydb dragonfly (src/redis/lua/struct modules). This vulnerability is associated with program files lua_struct.C. This issue …

CVE-2025-7709

An integer overflow exists in the FTS5 https://sqlite.org/fts5.html extension. It occurs when the size of an array of tombstone pointers …

CVE-2025-46819