Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).
CVE-2025-46819 — Integer Overflow or Wraparound in Redis
Severity
7.1HIGHNVD
OSV8.8
EPSS
5.0%
top 10.22%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
Timeline
PublishedOct 3
Latest updateMar 24
Description
Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted LUA script to read out-of-bound data or crash the server and subsequent denial of service. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to block a scri…
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:HExploitability: 1.8 | Impact: 5.2
Affected Packages21 packages
Patches
🔴Vulnerability Details
2💥Exploits & PoCs
1Nuclei▶
Redis < 8.2.1 Lua Long-String Delimiter - Out-of-Bounds Read
📋Vendor Advisories
6Debian▶
CVE-2025-46819: redict - Redis is an open source, in-memory database that persists on disk. Versions 8.2....↗2025