CVE-2025-46817 Lua library commands may lead to integer overflow and potential RCE

What is CVE-2025-46817?

CVE-2025-46817 is a high-severity vulnerability in redis, published on 3 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to cause an integer overflow and potentially lead to remote code execution The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2.

Weakness: CWE-190

Which versions are affected by CVE-2025-46817?

3 open source packages ship an affected version, including redis, keydb and valkey. It affects 1 product.

Products include Redis Redis.

How do I fix CVE-2025-46817?

Upgrade redis to a fixed version for your release line: 6.2.20, 7.2.11, 7.4.6 or 8.0.4.

Is CVE-2025-46817 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-46817 exists.

Public exploit code: 1 Nuclei template and 2 proofs of concept on GitHub.

Other vulnerabilities in redis

• CVE-2022-0543 Debian-specific Redis Server Lua Sandbox Escape Exploited Critical 10.0
• CVE-2026-23479 redis-server use-after-free in unblock client flow may allow remote code execution High 7.7
• CVE-2026-25243 redis-server RESTORE invalid memory access may allow remote code execution High 7.7
• CVE-2025-62507 Redis: Bug in XACKDEL may lead to stack overflow and potential RCE High 7.7
• CVE-2025-48367 Redis DoS Vulnerability due to bad connection error handling High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2025-46817, AZL-68238, AZL-68661, AZL-68664, BELL-CVE-2025-46817, BIT-keydb-2025-46817 and 12 more.