CVE-2025-46817: 
Redis vulnerability analysis and mitigation

CVE-2025-46817 affects Redis, an open source, in-memory database that persists on disk. The vulnerability was discovered and disclosed on October 3, 2025, affecting all versions of Redis up to 8.2.1 that include Lua scripting functionality. The vulnerability allows an authenticated user to use a specially crafted Lua script to cause an integer overflow and potentially lead to remote code execution (Redis Advisory, Redis Release).

The vulnerability is classified as an Integer Overflow or Wraparound (CWE-190) issue. It has been assigned a CVSS v3.1 base score of 7.0 (High) with the vector string CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. The vulnerability exists in the Lua scripting functionality of Redis, where improper handling of integer calculations in the unpack function could lead to an overflow condition (Redis Advisory).

Successful exploitation of this vulnerability could allow an authenticated attacker to execute arbitrary code remotely on the affected system. The vulnerability affects the confidentiality, integrity, and availability of the system, with all three aspects rated as High in the CVSS scoring (Redis Advisory).

The vulnerability has been fixed in Redis version 8.2.2. For users unable to update immediately, a workaround is available by preventing users from executing Lua scripts through ACL configuration. This can be achieved by blocking both the EVAL and FUNCTION command families (Redis Advisory, Redis Release).