Introduction
A flaw in how Redis handles Lua scripts lets authenticated users potentially compromise the entire server process. Remote code execution through a database scripting engine has direct, high-impact consequences for any environment that relies on Redis, so organizations using it for real-time analytics, caching, or session management need to know about this one. Redis is an open source in-memory database supported by Redis Ltd. and deployed in millions of production environments worldwide. It runs critical infrastructure for web applications, analytics platforms, and distributed systems.
Technical Information
CVE-2025-46817 is caused by insufficient input validation and boundary checking in the Redis Lua scripting environment. Authenticated users can submit specially crafted Lua scripts using commands such as EVAL or EVALSHA. By manipulating integer operations within these scripts, an attacker can trigger an integer overflow (CWE-190).
The vulnerability is present in all Redis versions with Lua scripting support up to and including 8.2.1. The root cause is improper handling of integer arithmetic during Lua script execution. When a script supplies input values that exceed the bounds of the underlying data types, the overflow can corrupt memory structures, which could lead to remote code execution in the context of the Redis server process. No public code snippets or exploit samples are available for this issue.
Affected Systems and Versions
- Redis Open Source and commercial distributions with Lua scripting support
- All versions up to and including 8.2.1
- Fixed in version 8.2.2
- Vulnerable configurations include any deployment where authenticated users can execute Lua scripts via
EVAL,EVALSHA, or similar commands
Vendor Security History
Redis Ltd. has fixed several Lua scripting vulnerabilities in recent years, including:
- CVE-2022-24735 (Lua script execution environment privilege escalation)
- CVE-2025-49844 (Lua use-after-free with potential remote code execution)
The vendor typically releases patches for high-severity issues within weeks of disclosure. Lua-related flaws keep recurring, though, which points to ongoing architectural difficulty in integrating scripting into the Redis core.
