CVE-2025-46817: redis Integer Overflow or Wraparound
Vulnerability summary
CVE-2025-46817 is a high (CVSS 8.8) Integer Overflow or Wraparound vulnerability in redis. EPSS estimates a 3.83% chance of exploitation in the next 30 days, higher than 89.9% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 32 · Related 14Timeline
- 03-10-2025PublishedVulnerability first disclosed.
- 03-10-2025Last modifiedVulnerability information updated.
Description
Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to cause an integer overflow and potentially lead to remote code execution The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2.
CVSS metrics
6 scores · 6 sources · 1 version- CVE.orgCNA7.0HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
- OSV · AlpineEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated7.0HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
EPSS trend
Probability
3.83%
Chance of exploitation in the next 30 days
Percentile
90%
Versus all other CVEs
30-day change
0.00 pp
From 3.83% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard5 products
- py3-redisAll versions (No fix recorded)
- py3.10-redisAll versions (No fix recorded)
- py3.11-redisAll versions (No fix recorded)
- py3.12-redisAll versions (No fix recorded)
- py3.13-redisAll versions (No fix recorded)
Debian3 products
- redict< 7.3.6+ds-1
- redis< 5:7.0.15-1~deb12u6 | < 5:8.0.2-3+deb13u1 | < 5:8.0.4-1
- valkey< 8.1.1+dfsg1-3+deb13u1 | < 8.1.4+dfsg1-1
Ubuntu2 products
- redictAll versions (No fix recorded)
- valkey< 7.2.11+dfsg1-0ubuntu0.2 | < 8.1.4+dfsg1-0ubuntu0.2
Alpine1 product
- valkey< 7.2.11-r0 | < 8.1.4-r0
Redis1 product
- redis< 8.2.2 | < 6.2.20 | ≥ 7.0, < 7.2.11 | ≥ 7.4.0, < 7.4.6 | ≥ 8.0.0, < 8.0.4 | ≥ 8.2.0, < 8.2.2
5 vendors · 12 products
References
11 links- github.com/redis/redis/security/advisories/GHSA-m8fj-85cg-7vhpX Refsource CONFIRMREPORTAdvisoryVendor Advisory
- github.com/redis/redis/commit/fc9abc775e308374f667fdf3e723ef4b7eb0e3caX Refsource MISCREPORTFIXPatch
