CVE-2025-46817

Public on 2025-10-03
Modified on 2025-10-07
Description
Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to cause an integer overflow and potentially lead to remote code execution The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2.
Severity
Important severity
Important
See what this means
CVSS v3 Base Score
7.0
See breakdown

Affected Packages

Platform Package Release Date Advisory Status
Amazon Linux 2 - Redis6 Extra redis 2025-10-14 ALAS2REDIS6-2025-015 Fixed
Amazon Linux 2023 redis6 2025-10-14 ALAS2023-2025-1222 Fixed
Amazon Linux 2023 valkey 2025-10-14 ALAS2023-2025-1221 Fixed

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv3 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD CVSSv3 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H