PT-2025-40593 · Redis+10 · Redis+10
Zhutyra
·
Published
2024-05-13
·
Updated
2026-05-18
·
CVE-2025-46819
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Redis versions 8.2.1 and below
Linux kernel versions (affected versions not specified)
Description
Redis, an in-memory database, is susceptible to a vulnerability where an authenticated user can execute a specially crafted Lua script to read out-of-bounds data or cause a server crash, leading to a denial of service. This issue affects all Redis versions that support Lua scripting. The vulnerability is resolved in Redis version 8.2.2. Additionally, a separate issue exists in the Linux kernel related to a NULL pointer dereference within the drm/amdgpu components. Exploitation of this kernel issue could lead to a denial of service.
Recommendations
Redis versions 8.2.1 and below: Upgrade to version 8.2.2 or later. As a workaround, prevent users from executing Lua scripts by restricting the
EVAL and FUNCTION command families using ACL.
Linux kernel (affected versions not specified): At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
DoS
Out of bounds Read
Integer Overflow
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Centos
Debian
Linuxmint
Red Hat
Red Os
Redis
Rocky Linux
Suse
Ubuntu