Search: CVE-2025-46819

Redis versions 7.2.10 and earlier, 8.0.0 through 8.0.5, and 8.1.0 through 8.1.3 are vulnerable to denial of service via specially crafted Lua scripts. An authenticated user can exploit this flaw to cause the server to crash or read out-of-bound data. The vulnerability affects all Redis versions with Lua scripting enabled. The issue is fixed in Redis version 8.2.2. As a workaround, administrators can restrict Lua script execution using ACLs to block the EVAL and FUNCTION command families.