CVE-2025-46819
📋 TL;DR
This vulnerability in Redis allows authenticated users to execute specially crafted LUA scripts that can read out-of-bounds memory or crash the server, causing denial of service. It affects all Redis versions with Lua scripting enabled, specifically versions 8.2.1 and below. Organizations running vulnerable Redis instances with authenticated user access are at risk.
💻 Affected Systems
- Redis
📦 What is this software?
Redis by Redis
Redis by Redis
Redis by Redis
Redis by Redis
Redis by Redis
⚠️ Risk & Real-World Impact
Worst Case
Complete server crash leading to extended denial of service, potential memory disclosure of sensitive data, and system instability requiring manual intervention.
Likely Case
Server crashes causing temporary denial of service, requiring restart and potentially disrupting dependent applications.
If Mitigated
Minimal impact if Lua scripting is disabled or proper ACL restrictions are in place, with only authenticated users affected.
🎯 Exploit Status
Exploitation requires authenticated access and knowledge of crafting malicious LUA scripts. The vulnerability is in the Lua scripting engine implementation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.2.2
Vendor Advisory: https://github.com/redis/redis/security/advisories/GHSA-4c68-q8q8-3g4f
Restart Required: Yes
Instructions:
1. Download Redis 8.2.2 or later from official sources. 2. Stop the Redis service. 3. Install the updated version. 4. Restart the Redis service. 5. Verify the version is 8.2.2 or higher.
🔧 Temporary Workarounds
Disable Lua Script Execution via ACL
allPrevent users from executing Lua scripts by restricting EVAL and FUNCTION command families using Redis ACL.
ACL SETUSER <username> -@scripting
ACL SETUSER <username> -@function
🧯 If You Can't Patch
- Implement strict ACL rules to block all users from executing Lua scripts using -@scripting and -@function
- Monitor Redis logs for unusual LUA script execution patterns and implement network segmentation to limit access
🔍 How to Verify
Check if Vulnerable:
Check Redis version and verify if Lua scripting is enabled. Versions 8.2.1 and below with Lua enabled are vulnerable.Check Version:
redis-cli --versionVerify Fix Applied:
Confirm Redis version is 8.2.2 or higher and test that Lua scripts execute without causing crashes or memory issues.📡 Detection & Monitoring
Log Indicators:
- Unusual LUA script execution patterns
- Redis server crash logs
- Memory access violation errors in Redis logs
Network Indicators:
- Increased EVAL command usage from authenticated users
- Unexpected server restarts
SIEM Query:
source="redis" AND (command="EVAL" OR command="FUNCTION") | stats count by src_ip🔗 References
- https://github.com/redis/redis/commit/3a1624da2449ac3dbfc4bdaed43adf77a0b7bfba
- https://github.com/redis/redis/releases/tag/8.2.2
- https://github.com/redis/redis/security/advisories/GHSA-4c68-q8q8-3g4f
- https://www.vicarius.io/vsociety/posts/cve-2025-46819-detect-redis-vulnerability
- https://www.vicarius.io/vsociety/posts/cve-2025-46819-mitigate-redis-vulnerability
