CVE-2025-46817
Executive Summary
CVE-2025-46817 is a critical integer overflow vulnerability in Redis, an open-source in-memory data structure store. An authenticated attacker can exploit this flaw by executing a specially crafted Lua script, leading to an integer overflow that may result in remote code execution (RCE). The vulnerability affects all Redis versions with Lua scripting enabled, up to and including version 8.2.1. The official fix is available in Redis version 8.2.2. Given the authenticated requirement and the availability of a public proof-of-concept (PoC) and a Nuclei template, this vulnerability poses a significant risk to exposed Redis instances.
This record — and 170,000+ others — are available via the ValtersIT API. One endpoint replaces five: NVD + GitHub CVE + CISA KEV + EPSS + Nuclei + Exploit-DB, unified.
No signup required
Supply Chain & Package Security
This vulnerability is inherent to the Redis core software itself, not a third-party package. However, organizations using Redis as a dependency in their applications (e.g., via Docker images, package managers, or cloud services) must ensure they are not running a vulnerable version. The supply chain risk is moderate, as the vulnerability requires authentication, but once authenticated, the impact is severe.
CVSS Breakdown & Threat Level
- CVSS Score: 7.0 (High)
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): Low (L) – requires valid Redis credentials
- User Interaction (UI): None (N)
- Scope (S): Unchanged (U)
- Confidentiality (C): High (H)
- Integrity (I): High (H)
- Availability (A): High (H)
Threat Level: Critical. The combination of low attack complexity, network exploitability, and potential for full system compromise makes this a high-priority vulnerability for patching.
Deep Dive & Mechanics
The vulnerability resides in Redis's Lua scripting engine. When a user submits a Lua script, Redis processes it within a sandboxed environment. However, due to an integer overflow in the handling of certain arithmetic operations or memory allocations within the script, an attacker can bypass the sandbox and execute arbitrary code on the host system.
Technical Details:
- Root Cause: Integer overflow in the Lua C API integration, specifically when handling large numbers or specific operations that exceed the expected bounds.
- Exploitation Path: An authenticated user sends a Lua script containing a crafted payload that triggers the overflow. This overflow corrupts memory, allowing the attacker to overwrite function pointers or other critical data structures.
- Impact: Successful exploitation leads to arbitrary code execution with the privileges of the Redis process (typically root or a dedicated user). This can be used to install backdoors, exfiltrate data, or pivot to other systems.
Vulnerable vs. Patched Code
Vulnerable Code (Redis <= 8.2.1):
The vulnerable code path involves the Lua lua_pushinteger or similar functions that do not properly validate the size of the integer before pushing it onto the stack. An attacker can provide a value that, when manipulated, causes an overflow.
// Simplified vulnerable example
void vulnerable_function(lua_State *L, int value) {
// No bounds checking
lua_pushinteger(L, value * 2); // Potential overflow
}
Patched Code (Redis >= 8.2.2): The fix introduces bounds checking and uses safe arithmetic functions to prevent overflow.
// Patched version
void patched_function(lua_State *L, int value) {
if (value > INT_MAX / 2) {
// Handle error or clamp value
lua_pushinteger(L, INT_MAX);
} else {
lua_pushinteger(L, value * 2);
}
}
Exploitation & Lab Setup
Red Team (Offensive)
Prerequisites:
- A Redis instance (version <= 8.2.1) with Lua scripting enabled.
- Valid credentials (or no password if authentication is disabled).
Exploitation Steps:
- Identify Target: Use Shodan or Nmap to find Redis instances.
- Authenticate: Connect to Redis using
redis-clior a script. - Craft Payload: Use a Lua script that triggers the integer overflow. A public PoC is available at
https://github.com/dwisiswant0/CVE-2025-46817. - Execute: Run the script via
EVALcommand. - Achieve RCE: The overflow leads to arbitrary code execution.
Example Command:
redis-cli -h target.com -p 6379 -a password EVAL "$(cat exploit.lua)" 0
Blue Team (Defensive)
Detection:
- Monitor Redis logs for unusual Lua script execution or errors.
- Use the Nuclei template provided to scan for vulnerable versions.
- Implement network segmentation to restrict access to Redis.
Honeypot Setup:
- Deploy a vulnerable Redis instance in a sandboxed environment to capture attacker behavior.
- Monitor for the specific Lua script patterns associated with this CVE.
Indicators of Compromise (IOCs)
- Network: Connections to Redis on port 6379 (default) from unusual IPs.
- Logs: Redis log entries containing
Lua scripterrors or unexpected integer values. - Process: Unusual child processes spawned by the Redis process (e.g., reverse shells).
- File: Creation of unexpected files in the Redis working directory (e.g.,
/tmp/).
Detection Engineering
YARA Rule
rule CVE_2025_46817_Redis_Lua_Overflow {
meta:
description = "Detects Lua scripts exploiting CVE-2025-46817 integer overflow in Redis"
author = "Valters IT"
date = "2025-04-10"
reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-46817"
strings:
$overflow_pattern = /lua_pushinteger.*\d{10,}/ // Large integer in Lua push
$eval_command = "EVAL" nocase
condition:
$eval_command and $overflow_pattern
}
Sigma Rule
title: Redis Lua Script Integer Overflow Exploitation
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit CVE-2025-46817 via Lua script execution
author: Valters IT
logsource:
category: application
product: redis
detection:
selection:
EventID: 12345 # Hypothetical Redis event ID for Lua errors
Message|contains: "integer overflow"
condition: selection
falsepositives:
- Legitimate use of large integers in Lua scripts (rare)
level: high
Suricata Rule
alert tcp $HOME_NET any -> $EXTERNAL_NET 6379 (msg:"CVE-2025-46817 Redis Lua Integer Overflow Attempt"; flow:to_server,established; content:"EVAL"; nocase; content:"lua_pushinteger"; distance:0; within:100; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2025-46817; classtype:attempted-admin; sid:1000001; rev:1;)
Nuclei Template (Provided)
id: CVE-2025-46817
info:
name: Redis < 8.2.1 lua script - Integer Overflow
author: pussycat0x
severity: critical
description: |
Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to cause an integer overflow and potentially lead to remote code execution The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2.
impact: |
Authenticated users can execute arbitrary code remotely, potentially compromising the entire system.
remediation: |
Update to version 8.2.2 or later.
reference:
- https://github.com/dwisiswant0/CVE-2025-46817/blob/master/README.md
metadata:
verified: true
max-request: 1
shodan-query: product:"redis"
tags: cve,cve2025,js,redis,network,passive,authenticated,vuln
flow: javascript(1) && javascript(2)
javascript:
- pre-condition: |
isPortOpen(Host,Port);
code: |
const redis = require('nuclei/redis');
const info = redis.GetServerInfo(Host,Port);
Export(info);
args:
Host: "{{Host}}"
Port: "6379"
matchers:
- type: dsl
dsl:
- success == true
- compare_versions(version, ' <= 8.2.1')
condition: and
extractors:
- type: regex
name: version
part: response
group: 1
regex:
- redis_version:(\d+\.\d+\.\d+)
- code: |
const redis = require('nuclei/redis');
const info = redis.RunLuaScript(Host,Port,Password,Payload);
Export(info);
args:
Host: "{{Host}}"
Port: "6379"
Password: "{{passwords}}"
Payload: 'return "lua enabled"'
payloads:
passwords:
- ""
matchers:
- type: dsl
dsl:
- success == true
- contains(response, 'lua enabled')
condition: and
internal: true
# digest: 490a004630440220080a6659d3227d58a0fa8dc7bd43125de8a2e35e2495dc3333d2a4bbfd52eaca02203e7ef01f288abeef90e8fbef910a07079b3e259c88d44adb9e89e2a27f4783a2:922c64590222798bb761d5b6d8e72950
Remediation & Mitigation
Immediate Actions:
- Patch: Upgrade Redis to version 8.2.2 or later.
- Restrict Access: Use firewall rules to limit Redis access to trusted IPs only.
- Authentication: Ensure Redis requires strong authentication (requirepass).
- Disable Lua: If not needed, disable Lua scripting by setting
lua-time-limit 0or removing theloadmodulefor Lua.
Long-term Measures:
- Implement network segmentation for Redis instances.
- Regularly audit Redis configurations and logs.
- Use a Web Application Firewall (WAF) or intrusion detection system (IDS) to monitor for exploit attempts.
Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert
{/* [Security Hash: CA7A3FEA5D6536F61F9BAFFE] */}