Redis: Lua library commands may lead to integer overflow and potential RCE (CVE-2025-46817)
Redis versions 8.2.1 and below contain a vulnerability in their Lua scripting library that allows an authenticated user to cause an integer overflow, potentially leading to remote code execution (CVE-2025-46817). This issue affects all Redis versions with Lua scripting and is fixed in version 8.2.2. The vulnerability is rated as high severity by Red Hat Product Security. Red Hat has released security updates addressing this issue in their Redis packages for various architectures and distributions, including Red Hat Enterprise Linux 9.4 Extended Update Support. Users are advised to apply these updates to mitigate the risk.
AI Analysis
Technical Summary
CVE-2025-46817 is a vulnerability in Redis, an open-source in-memory database, where specially crafted Lua scripts can trigger an integer overflow leading to potential remote code execution (RCE). This affects all Redis versions supporting Lua scripting up to 8.2.1. The vulnerability is fixed in Redis version 8.2.2. Red Hat's advisory RHSA-2025:18931 confirms the issue and provides updated Redis packages for Red Hat Enterprise Linux 9.4 Extended Update Support and related platforms. The advisory also references a related use-after-free vulnerability (CVE-2025-49844).
Potential Impact
An authenticated user can exploit this vulnerability by submitting a crafted Lua script to cause an integer overflow, potentially leading to remote code execution on the Redis server. This could allow attackers to execute arbitrary code with the privileges of the Redis process, posing a significant security risk.
Mitigation Recommendations
A fix is available and has been released in Redis version 8.2.2. Red Hat has published updated Redis packages addressing this vulnerability for Red Hat Enterprise Linux 9.4 Extended Update Support and other supported platforms. Users should apply these official updates promptly to remediate the issue. Refer to the Red Hat advisory RHSA-2025:18931 and the update instructions at https://access.redhat.com/articles/11258 for detailed guidance.
Redis: Lua library commands may lead to integer overflow and potential RCE (CVE-2025-46817)
Description
Redis versions 8.2.1 and below contain a vulnerability in their Lua scripting library that allows an authenticated user to cause an integer overflow, potentially leading to remote code execution (CVE-2025-46817). This issue affects all Redis versions with Lua scripting and is fixed in version 8.2.2. The vulnerability is rated as high severity by Red Hat Product Security. Red Hat has released security updates addressing this issue in their Redis packages for various architectures and distributions, including Red Hat Enterprise Linux 9.4 Extended Update Support. Users are advised to apply these updates to mitigate the risk.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-46817 is a vulnerability in Redis, an open-source in-memory database, where specially crafted Lua scripts can trigger an integer overflow leading to potential remote code execution (RCE). This affects all Redis versions supporting Lua scripting up to 8.2.1. The vulnerability is fixed in Redis version 8.2.2. Red Hat's advisory RHSA-2025:18931 confirms the issue and provides updated Redis packages for Red Hat Enterprise Linux 9.4 Extended Update Support and related platforms. The advisory also references a related use-after-free vulnerability (CVE-2025-49844).
Potential Impact
An authenticated user can exploit this vulnerability by submitting a crafted Lua script to cause an integer overflow, potentially leading to remote code execution on the Redis server. This could allow attackers to execute arbitrary code with the privileges of the Redis process, posing a significant security risk.
Mitigation Recommendations
A fix is available and has been released in Redis version 8.2.2. Red Hat has published updated Redis packages addressing this vulnerability for Red Hat Enterprise Linux 9.4 Extended Update Support and other supported platforms. Users should apply these official updates promptly to remediate the issue. Refer to the Red Hat advisory RHSA-2025:18931 and the update instructions at https://access.redhat.com/articles/11258 for detailed guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2025:18931
- Cve Count
- 2
- Additional Cves
- ["CVE-2025-49844"]
Threat ID: 6a419cb027e9c79719abb0d1
Added to database: 06/28/2026, 22:14:08 UTC
Last enriched: 09/08/2026, 15:10:58 UTC
Last updated: 09/10/2026, 19:36:50 UTC
Views: 21
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.