CVE-2025-46819: 
Redis vulnerability analysis and mitigation

Redis versions 8.2.1 and below contain a vulnerability (CVE-2025-46819) that allows an authenticated user to execute specially crafted LUA scripts leading to out-of-bounds data reads or server crashes. The vulnerability was discovered and disclosed on October 3, 2025, affecting all versions of Redis with Lua scripting capabilities (NVD, GitHub Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 7.1 (HIGH) by NIST with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H, while GitHub rates it at 6.3 (MEDIUM) with vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H. The vulnerability is classified under CWE-125 (Out-of-bounds Read) and CWE-190 (Integer Overflow or Wraparound). The issue specifically exists in the Redis server's embedded Lua engine where scripts execute (NVD, Red Hat).

The vulnerability can lead to information disclosure through out-of-bounds memory reads and denial of service through server crashes. The attack surface is limited to environments where the attacker has valid credentials and can invoke Lua (EVAL/FUNCTION) commands. Client libraries (Python, Node.js, Rust, etc.) are not affected by this vulnerability (Red Hat).

The vulnerability has been fixed in Redis version 8.2.2. For systems that cannot be immediately patched, a workaround is available by preventing users from executing Lua scripts through ACL restrictions on both the EVAL and FUNCTION command families. Additional recommended mitigations include restricting network access to trusted hosts, enforcing strong authentication and protected-mode, applying least-privilege ACLs, keeping instances non-public with firewalls/VPCs, and following Redis hardening guidance (NVD, Red Hat).