This advisory covers two vulnerabilities in Redis 6 as distributed by Red Hat for RHEL 8.6. CVE-2025-46817 involves Lua library commands that may cause an integer overflow, potentially enabling remote code execution. CVE-2025-49844 is a use-after-free vulnerability in Redis Lua that may also lead to remote code execution. Red Hat has released a security update (RHSA-2025:19239) that addresses these issues by patching the redis:6 module. The update applies to multiple RHEL 8.6 variants including Advanced Mission Critical Update Support, Update Services for SAP Solutions, and Telecommunications Update Service. No CVSS scores are provided in the advisory, but the severity is rated as Important by Red Hat Product Security.

Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code remotely on affected systems running the vulnerable Redis 6 module. This could lead to full compromise of the Redis service and potentially the underlying host. The integer overflow and use-after-free issues specifically affect Lua scripting functionality within Redis, which is commonly used for advanced data processing. No known exploits in the wild have been reported at the time of this advisory.

Red Hat has released an official security update for the redis:6 module in Red Hat Enterprise Linux 8.6 that addresses these vulnerabilities. Users should apply the update promptly by following the instructions in the Red Hat advisory (https://access.redhat.com/articles/11258). Since this is a traditional software package and not a cloud service, remediation requires manual update by system administrators. No additional mitigations or workarounds are specified in the advisory.