← Back

CVE-2025-46817

nvd nistnuclei
Published: Oct 3, 2025Modified: Jun 17, 2026

JSON object

Loading...
8.8
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability: 2.8 / Impact: 5.9
Source: NVD

Description

Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to cause an integer overflow and potentially lead to remote code execution The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2.

Affected (5)

Products: Redis: Redis
Redis
1 product
Redis
Configuration A
5 vulnerable
Vulnerable SoftwareAffected Versions
Redis
Redis
Before 6.2.20
Redis
From 7.0 to 7.2.11
Redis
From 7.4.0 to 7.4.6
Redis
From 8.0.0 to 8.0.4
Redis
From 8.2.0 to 8.2.2

Related CWEs

CWE-190
Integer Overflow or Wraparound
The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

References (3)

Source: security-advisories@github.com
Patch
Source: security-advisories@github.com
Release Notes
Source: security-advisories@github.com
Vendor Advisory

Timeline

No history available yet.