CVE-2025-46817: Lua library commands may lead to integer overflow and potential RCE
Lua library commands may lead to integer overflow and potential RCE
Other sources
Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to cause an integer overflow and potentially lead to remote code execution The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/redictto a version that resolves this vulnerability.Fixed in 7.3.6-r0 - Upgrade
Upgrade
alpine/redisto a version that resolves this vulnerability.Fixed in 7.2.11-r0 - Upgrade
Upgrade
alpine/redisto a version that resolves this vulnerability.Fixed in 8.0.4-r0 - Upgrade
Upgrade
alpine/redisto a version that resolves this vulnerability.Fixed in 8.2.2-r0 - Upgrade
Upgrade
alpine/valkeyto a version that resolves this vulnerability.Fixed in 7.2.11-r0 - Upgrade
Upgrade
alpine/valkeyto a version that resolves this vulnerability.Fixed in 8.1.4-r0 - Upgrade
Upgrade
Redisto a version that resolves this vulnerability.Fixed in 8.2.2
Event History
Frequently Asked Questions
What is the severity of CVE-2025-46817?
CVE-2025-46817 is considered critical due to its potential for remote code execution via integer overflow.
How do I fix CVE-2025-46817?
To fix CVE-2025-46817, upgrade Redis to version 8.2.2 or later.
Which versions of Redis are affected by CVE-2025-46817?
CVE-2025-46817 affects Redis versions 8.2.1 and below.
Can an unauthenticated user exploit CVE-2025-46817?
No, an authenticated user is required to exploit CVE-2025-46817.
What type of vulnerability is CVE-2025-46817?
CVE-2025-46817 is an integer overflow vulnerability that can lead to remote code execution.