Valkey: Redis is vulnerable to DoS via specially crafted LUA scripts (CVE-2025-46819)
Redis versions 7.2.10 and earlier, 8.0.0 through 8.0.5, and 8.1.0 through 8.1.3 are vulnerable to denial of service via specially crafted Lua scripts. An authenticated user can exploit this flaw to cause the server to crash or read out-of-bound data. The vulnerability affects all Redis versions with Lua scripting enabled. The issue is fixed in Redis version 8.2.2. As a workaround, administrators can restrict Lua script execution using ACLs to block the EVAL and FUNCTION command families.
AI Analysis
Technical Summary
Redis, an open source in-memory database, is vulnerable to denial of service attacks through specially crafted Lua scripts in versions <7.2.11, >=8.0.0 <8.0.6, and >=8.1.0 <8.1.4. Authenticated users can exploit this vulnerability to cause server crashes or read out-of-bound data. The vulnerability affects all Redis versions that support Lua scripting. The issue is resolved in version 8.2.2. Until patching, administrators can mitigate risk by disabling Lua script execution via ACL restrictions on EVAL and FUNCTION commands.
Potential Impact
An authenticated attacker can cause the Redis server to crash, resulting in denial of service, or potentially read out-of-bound data. This disrupts availability and may expose unintended data. There are no known exploits in the wild at this time.
Mitigation Recommendations
A patch is available in Redis version 8.2.2 and should be applied to remediate this vulnerability. Until patching, administrators can prevent exploitation by disabling Lua script execution using ACLs to restrict the EVAL and FUNCTION command families. No other actions are required if these mitigations are in place.
Valkey: Redis is vulnerable to DoS via specially crafted LUA scripts (CVE-2025-46819)
Description
Redis versions 7.2.10 and earlier, 8.0.0 through 8.0.5, and 8.1.0 through 8.1.3 are vulnerable to denial of service via specially crafted Lua scripts. An authenticated user can exploit this flaw to cause the server to crash or read out-of-bound data. The vulnerability affects all Redis versions with Lua scripting enabled. The issue is fixed in Redis version 8.2.2. As a workaround, administrators can restrict Lua script execution using ACLs to block the EVAL and FUNCTION command families.
Affected software
pkg:bitnami/valkeyRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Redis, an open source in-memory database, is vulnerable to denial of service attacks through specially crafted Lua scripts in versions <7.2.11, >=8.0.0 <8.0.6, and >=8.1.0 <8.1.4. Authenticated users can exploit this vulnerability to cause server crashes or read out-of-bound data. The vulnerability affects all Redis versions that support Lua scripting. The issue is resolved in version 8.2.2. Until patching, administrators can mitigate risk by disabling Lua script execution via ACL restrictions on EVAL and FUNCTION commands.
Potential Impact
An authenticated attacker can cause the Redis server to crash, resulting in denial of service, or potentially read out-of-bound data. This disrupts availability and may expose unintended data. There are no known exploits in the wild at this time.
Mitigation Recommendations
A patch is available in Redis version 8.2.2 and should be applied to remediate this vulnerability. Until patching, administrators can prevent exploitation by disabling Lua script execution using ACLs to restrict the EVAL and FUNCTION command families. No other actions are required if these mitigations are in place.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BIT-valkey-2025-46819
- Osv Schema Version
- 1.6.2
- Aliases
- ["CVE-2025-46819"]
- Ecosystems
- ["Bitnami"]
- Database Specific Severity
- High
- Cvss Version
- null
Patch Information
Threat ID: 6aa005b3acd9273b49ab58af
Added to database: 09/08/2026, 12:55:15 UTC
Last enriched: 09/08/2026, 13:19:38 UTC
Last updated: 09/08/2026, 22:52:06 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.