Skip to content
OpenAdvisories
High · 7.0 Scanner template Public exploit CVE-2025-46817 EUVD-2025-33202

Lua library commands may lead to integer overflow and potential RCE

Published Oct 3, 2025 · Updated Oct 3, 2025 · Assigned by GitHub_M

Vendor: Redis Product: Redis Package: compat-lua Package: redict Package: redict Package: redict Package: redis Package: redis Package: valkey Package: valkey Package: valkey Package: valkey Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to cause an integer overflow and potentially lead to remote code execution The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2.

Affected products

VendorProductAffectedFixed
redis redis < 8.2.2 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 redis 5:8.0.4-1 —
Debian 14 valkey 8.1.4+dfsg1-1 —
Debian 13 redis 5:8.0.2-3+deb13u1 DSA-6020-1
Debian 13 valkey 8.1.1+dfsg1-3+deb13u1 DSA-6022-1
Debian 12 redis 5:7.0.15-1~deb12u6 DSA-6020-1
Debian 11 redis 5:6.0.16-1+deb11u8 DLA-4325-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 redict No fix yet —
Ubuntu 26.04 LTS redict No fix yet —
Ubuntu 25.10 redict No fix yet —
Ubuntu 25.10 valkey 8.1.4+dfsg1-0ubuntu0.2 USN-7893-1
Ubuntu 24.04 LTS valkey 7.2.11+dfsg1-0ubuntu0.2 USN-7893-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 valkey +1 8.0.6-1.el10_0 RHSA-2025:21936, RHSA-2025:19675
RHEL 9 redis +2 6.2.20-1.el9_6 RHSA-2025:20955, RHSA-2025:20926, RHSA-2025:19345
RHEL 9 valkey +1 8.0.6-2.el9_7 RHSA-2025:21916
RHEL 8 redis +2 6.2.20-1.module+el8.10.0+23551+d4cd15d7 RHSA-2025:19238
Show 10 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 9.4 EUS redis +2 6.2.7-1.el9_4.5 RHSA-2025:18996, RHSA-2025:18931
RHEL 9.2 E4S redis +2 6.2.7-1.el9_2.5 RHSA-2025:19086
RHEL 9.0 E4S redis +2 6.2.6-1.el9_0.5 RHSA-2025:18997
RHEL 8.8 TUS redis +2 6.2.7-1.module+el8.8.0+23580+a818c120.6 RHSA-2025:19399
RHEL 8.8 E4S redis +2 6.2.7-1.module+el8.8.0+23580+a818c120.6 RHSA-2025:19399
RHEL 8.6 TUS redis +2 6.0.9-5.module+el8.6.0+23584+001f3496.6 RHSA-2025:19239
RHEL 8.6 E4S redis +2 6.0.9-5.module+el8.6.0+23584+001f3496.6 RHSA-2025:19239
RHEL 8.6 AUS redis +2 6.0.9-5.module+el8.6.0+23584+001f3496.6 RHSA-2025:19239
RHEL 8.4 EUS Long Life redis +2 6.0.9-5.module+el8.4.0+23585+fb4eb024.5 RHSA-2025:19318
RHEL 8.4 AUS redis +2 6.0.9-5.module+el8.4.0+23585+fb4eb024.5 RHSA-2025:19318

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 valkey +1 8.0.6-1.el10_0 ALSA-2025:21936, ALSA-2025:19675
AlmaLinux 9 redis +2 6.2.20-1.el9_6 ALSA-2025:20955, ALSA-2025:20926, ALSA-2025:19345
AlmaLinux 9 valkey +1 8.0.6-2.el9_7 ALSA-2025:21916
AlmaLinux 8 redis +2 6.2.20-1.module_el8.10.0+4056+739731b0 ALSA-2025:19238

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 valkey 8.0.6-1.el10_0 RLSA-2025:21936, RLSA-2025:19675
Rocky Linux 9 redis 6.2.20-1.el9_6 RLSA-2025:20955, RLSA-2025:20926, RLSA-2025:19345
Rocky Linux 9 valkey 8.0.6-2.el9_7 RLSA-2025:21916
Rocky Linux 8 redis 6.2.20-1.module+el8.10.0+2081+450a296c RLSA-2025:19238

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 valkey 8.0.6-150700.3.11.1 SUSE-SU-2025:03502-1
SLES 15 SP6 redis 7.2.4-150600.3.18.1 SUSE-SU-2025:03505-1
SLES 15 SP6 redis7 7.0.8-150600.8.19.1 SUSE-SU-2025:03500-1
SLES 15 SP6 valkey 8.0.6-150600.13.17.1 SUSE-SU-2025:03499-1
SLES 15 SP5 redis 6.2.6-150400.3.40.1 SUSE-SU-2025:03506-1
SLES 15 SP5 redis7 7.0.8-150500.3.24.1 SUSE-SU-2025:03501-1
SLES 15 SP4 redis 6.2.6-150400.3.40.1 SUSE-SU-2025:03506-1
SLES 15 SP3 redis 6.0.14-150200.6.43.1 SUSE-SU-2025:03507-1
Show 11 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 valkey 8.0.6-160000.1.1 SUSE-SU-2026:20022-1
SLES for SAP 15 SP5 redis 6.2.6-150400.3.40.1 SUSE-SU-2025:03506-1
SLES for SAP 15 SP5 redis7 7.0.8-150500.3.24.1 SUSE-SU-2025:03501-1
SLES for SAP 15 SP4 redis 6.2.6-150400.3.40.1 SUSE-SU-2025:03506-1
SLES for SAP 15 SP3 redis 6.0.14-150200.6.43.1 SUSE-SU-2025:03507-1
SLES 16.0 valkey 8.0.6-160000.1.1 SUSE-SU-2026:20022-1
SLE HPC 15 SP5 redis 6.2.6-150400.3.40.1 SUSE-SU-2025:03506-1
SLE HPC 15 SP5 redis7 7.0.8-150500.3.24.1 SUSE-SU-2025:03501-1
SLE HPC 15 SP4 redis 6.2.6-150400.3.40.1 SUSE-SU-2025:03506-1
SLE HPC 15 SP3 redis 6.0.14-150200.6.43.1 SUSE-SU-2025:03507-1
SUSE Manager Server LTS 4.3 redis 6.2.6-150400.3.40.1 SUSE-SU-2025:03506-1
SUSE Manager Proxy LTS 4.3 redis 6.2.6-150400.3.40.1 SUSE-SU-2025:03506-1
SUSE Enterprise Storage 7.1 redis 6.0.14-150200.6.43.1 SUSE-SU-2025:03507-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed redis 8.2.2-1.1 openSUSE-SU-2025:15600-1
openSUSE Tumbleweed valkey 8.1.4-1.1 openSUSE-SU-2025:15604-1
openSUSE Leap 16.0 redis 8.2.3-bp160.1.1 openSUSE-SU-2025:20121-1
openSUSE Leap 16.0 valkey 8.0.6-160000.1.1 openSUSE-SU-2026:20003-1
openSUSE Leap 15.6 redis 7.2.4-150600.3.18.1 SUSE-SU-2025:03505-1
openSUSE Leap 15.6 redis7 7.0.8-150600.8.19.1 SUSE-SU-2025:03500-1
openSUSE Leap 15.6 valkey 8.0.6-150600.13.17.1 SUSE-SU-2025:03499-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 redict 7.3.6-r0 —
Alpine v3.24 redis 8.2.2-r0 —
Alpine v3.24 valkey 8.1.4-r0 —
Alpine v3.23 redict 7.3.6-r0 —
Alpine v3.23 redis 8.2.2-r0 —
Alpine v3.23 valkey 8.1.4-r0 —
Alpine v3.22 redict 7.3.6-r0 —
Alpine v3.22 redis 8.0.4-r0 —
Alpine v3.22 valkey 8.1.4-r0 —
Alpine v3.21 redis +1 7.2.11-r0 —
Alpine v3.20 valkey 7.2.11-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 redis6 +2 6.2.20-2.amzn2023.0.1 ALAS2023-2025-1222
Amazon Linux 2023 valkey +1 8.0.6-3.amzn2023.0.2 ALAS2023-2025-1221

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 compat-lua No fix yet —
Azure Linux 3 valkey 8.0.6-1 —
Azure Linux 2 (CBL-Mariner) compat-lua No fix yet —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 valkey +1 8.0.6-1.0.1.el10_0 ELSA-2025-21936, ELSA-2025-19675
Oracle Linux 9 redis +2 6.2.20-1.el9_6 ELSA-2025-20955, ELSA-2025-20926, ELSA-2025-19345
Oracle Linux 9 valkey +1 8.0.6-2.el9_7 ELSA-2025-21916
Oracle Linux 8 redis +2 6.2.20-1.0.1.module+el8.10.0+90692+1027f9f2 ELSA-2025-19238

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 2 repositories

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Automated scanner template

A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.

Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.

Advisories 50

References