Skip to main content
CVE-2025-46817VulnerabilityPublished Updated

Red Hat Security Advisory: valkey security update

Affects Red HatSource GCVE Database

0

Mentioned vulnerabilities

Not known to be exploited · public detection template (Nuclei).

Data as of 25 Oct 2026, 19:02 UTC

Severity
High

Rated by Threat Radar · No CVSS score from NVD or the CNA

EPSS
3.9% chance of exploitation in 30 days – higher than 90% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

Exploitation evidence

  1. Disclosed: evidence found.

    CVE published 4 Nov 2025

  2. Detectable: evidence found.

    nuclei template: Redis < 8.2.1 lua script - Integer Overflow

  3. Weaponised: no evidence on record.

    No public exploit code indexed in Metasploit or Exploit-DB

  4. Exploited in the wild: no evidence on record.

    Not in CISA KEV and no source reports exploitation

  5. Observed by OffSeq Mirage: no evidence on record.

    No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.

What to do

Affected software

ProductAffectedFixed in
Red Hatredhat/valkeypkg:rpm/redhat/valkeyOther threatsAffected
  • =8.0.6-1.el10_0
Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

Red Hat has released security updates for Valkey in Red Hat Enterprise Linux 10 that address these vulnerabilities. Users should apply the available patches as described in the Red Hat advisory RHSA-2025:19675. For detailed update instructions, refer to https://access.redhat.com/articles/11258. No indication exists that these issues are already mitigated or require alternative workarounds beyond applying the official update.

Description

Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set. In order to achieve its outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log. Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth. Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave like a cache. You can use Valkey from most programming languages also. Security Fix(es): * redis: Lua library commands may lead to integer overflow and potential RCE (CVE-2025-46817) * Redis: Redis: Authenticated users can execute LUA scripts as a different user (CVE-2025-46818) * Redis: Redis is vulnerable to DoS via specially crafted LUA scripts (CVE-2025-46819) * Redis: Redis Lua Use-After-Free may lead to remote code execution (CVE-2025-49844) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

Community reviews

Loading reviews…