CVE-2025-46819
Executive Summary
CVE-2025-46819 is a high-severity vulnerability in Redis, an open-source, in-memory data structure store. The flaw resides in the Lua scripting engine, affecting all versions of Redis with Lua scripting support up to and including version 8.2.1. An authenticated attacker can exploit this vulnerability by executing a specially crafted Lua script, leading to an out-of-bounds read. This can result in the disclosure of sensitive in-memory data or a crash of the Redis server, causing a denial of service (DoS). The vulnerability is triggered through the EVAL or FUNCTION command families. The official fix is available in Redis version 8.2.2. A workaround exists by restricting Lua script execution via ACL rules.
This record — and 170,000+ others — are available via the ValtersIT API. One endpoint replaces five: NVD + GitHub CVE + CISA KEV + EPSS + Nuclei + Exploit-DB, unified.
No signup required
Supply Chain & Package Security
This vulnerability affects the Redis server software itself, not a specific package manager (NPM, PyPI, Go, Ruby). However, organizations using Redis as a dependency in their applications should assess their exposure. The risk is primarily to the availability and confidentiality of the Redis instance and the data it manages. Supply chain risk is indirect, as compromised Redis instances could be used to pivot to other systems.
CVSS Breakdown & Threat Level
- CVSS Score: 6.3 (Medium)
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
- Attack Vector (AV): Network (N) - The attack can be launched remotely over the network.
- Attack Complexity (AC): Low (L) - No special conditions are required for exploitation.
- Privileges Required (PR): Low (L) - The attacker must have valid authentication credentials to the Redis server.
- User Interaction (UI): None (N) - No user interaction is required.
- Scope (S): Unchanged (U) - The vulnerability does not affect resources beyond the Redis server.
- Confidentiality (C): Low (L) - Limited out-of-bounds read may expose some memory contents.
- Integrity (I): None (N) - No data modification is possible.
- Availability (A): High (H) - The vulnerability can cause a server crash, leading to a denial of service.
Threat Level: High. While the CVSS score is 6.3, the potential for denial of service and the low complexity of exploitation make this a significant threat for authenticated users.
Deep Dive & Mechanics
The vulnerability is an out-of-bounds read within the Lua scripting engine of Redis. Lua scripts are executed in a sandboxed environment, but a flaw in the handling of long-string delimiters allows an attacker to craft a script that reads memory beyond the intended buffer.
Root Cause: The issue lies in how Redis parses and processes Lua scripts, specifically when dealing with long-string delimiters (e.g., [[...]]). A specially crafted script can cause the parser to read past the allocated memory boundary, leading to an out-of-bounds read.
Attack Vector:
- Authentication: The attacker must first authenticate to the Redis server. This can be done using a valid password or if authentication is disabled.
- Lua Script Execution: The attacker sends a malicious Lua script using the
EVALorFUNCTIONcommand. - Exploitation: The script triggers the out-of-bounds read, causing the server to either crash (DoS) or return sensitive data from adjacent memory.
Impact:
- Denial of Service (DoS): The most likely outcome is a server crash, making the Redis service unavailable.
- Information Disclosure: In some cases, the out-of-bounds read may return fragments of memory, potentially leaking sensitive data such as other users' keys, passwords, or internal server data.
Vulnerable vs. Patched Code
The exact code change is not publicly available, but the fix is in Redis version 8.2.2. The vulnerable code likely resides in the Lua script parser, where long-string delimiters are handled. The patch introduces bounds checking to ensure that the parser does not read beyond the allocated buffer.
Vulnerable Code (Conceptual):
// Vulnerable: No bounds checking on long-string delimiter
char *parse_long_string(char *input) {
char *start = input;
while (*input != ']' && *(input+1) != ']') {
input++;
}
// Potential out-of-bounds read if input is malformed
return input;
}
Patched Code (Conceptual):
// Patched: Bounds checking added
char *parse_long_string(char *input, size_t input_len) {
char *start = input;
size_t offset = 0;
while (offset < input_len && (input[offset] != ']' || input[offset+1] != ']')) {
offset++;
}
if (offset >= input_len) {
// Handle error: malformed input
return NULL;
}
return input + offset;
}
Exploitation & Lab Setup
Red Team (Exploitation)
Prerequisites:
- A Redis server (version < 8.2.2) with Lua scripting enabled.
- Valid authentication credentials (or no authentication).
- Network access to the Redis port (default 6379).
Exploitation Steps:
- Connect to Redis: Use the
redis-clitool or a custom script. - Authenticate:
AUTH <password>(if required). - Execute Malicious Lua Script: Send a crafted Lua script that triggers the out-of-bounds read.
Example Malicious Lua Script (Conceptual):
-- This script is designed to cause an out-of-bounds read
local a = "[["
local b = string.rep("A", 10000)
local c = a .. b .. "]]"
return loadstring(c)()
Using the Nuclei Template: The provided Nuclei template can be used to automate detection and exploitation. It first checks the Redis version, then attempts to run a simple Lua script to confirm Lua execution.
nuclei -t CVE-2025-46819.yaml -target redis://target-ip:6379
Note: The template requires the nuclei/redis module. Ensure it is installed.
Blue Team (Detection & Defense)
Detection:
- Monitor Redis logs for unusual Lua script execution patterns.
- Look for repeated
EVALorFUNCTIONcommands from the same user. - Use network monitoring to detect anomalous traffic to port 6379.
Defense:
- Patch: Upgrade to Redis version 8.2.2 or later.
- Workaround: Use ACLs to restrict Lua script execution. Block the
EVALandFUNCTIONcommand families for untrusted users.ACL SETUSER <username> -EVAL -FUNCTION - Network Segmentation: Restrict access to the Redis port to only trusted hosts.
- Authentication: Ensure strong authentication is enabled for all Redis connections.
Indicators of Compromise (IOCs)
- Network:
- Unusual Lua script payloads in Redis traffic.
- Repeated
EVALorFUNCTIONcommands from a single source.
- Host:
- Redis server crashes or restarts.
- Redis logs containing errors related to Lua script execution.
- High memory usage or CPU spikes during Lua script execution.
- File:
- No specific file-based IOCs.
Detection Engineering
YARA Rule
rule CVE_2025_46819_Redis_Lua_OOB {
meta:
description = "Detects malicious Lua scripts targeting CVE-2025-46819"
author = "Valters IT"
date = "2025-04-10"
reference = "CVE-2025-46819"
strings:
$lua_delimiter = "[["
$lua_long_string = /\[\[[^\]]{100,}\]\]/ // Long string with many characters
$eval_command = "EVAL"
$function_command = "FUNCTION"
condition:
($eval_command or $function_command) and $lua_long_string
}
Sigma Rule
title: CVE-2025-46819 Redis Lua Script Out-of-Bounds Read
id: 8a7b3c2d-1e5f-4a6b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit CVE-2025-46819 via malicious Lua scripts
author: Valters IT
date: 2025-04-10
logsource:
category: application
product: redis
detection:
selection:
EventID: "LUA_SCRIPT_EXECUTION"
ScriptContent|contains: "[["
ScriptContent|re: '\[\[[^\]]{100,}\]\]'
condition: selection
falsepositives:
- Legitimate use of long Lua strings
level: high
Suricata Rule
alert tcp $EXTERNAL_NET any -> $HOME_NET 6379 (msg:"CVE-2025-46819 Redis Lua Script Out-of-Bounds Read Attempt"; flow:to_server,established; content:"EVAL"; nocase; content:"[["; distance:0; within:100; pcre:"/\[\[[^\]]{100,}\]\]/"; classtype:attempted-dos; sid:1000001; rev:1;)
Nuclei Template (Provided)
id: CVE-2025-46819
info:
name: Redis < 8.2.1 Lua Long-String Delimiter - Out-of-Bounds Read
author: pussycat0x
severity: high
description: |
Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted LUA script to read out-of-bound data or crash the server and subsequent denial of service. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to block a script by restricting both the EVAL and FUNCTION command families.
impact: |
Authenticated attackers can use specially crafted Lua scripts to read out-of-bound data or crash the Redis server, causing denial of service.
reference:
- https://github.com/dwisiswant0/CVE-2025-46819
remediation: |
Update to version 8.2.2 or later.
metadata:
verified: true
max-request: 1
shodan-query: product:"redis"
tags: cve,cve2025,js,redis,network,passive,authenticated,vuln
flow: javascript(1) && javascript(2)
javascript:
- pre-condition: |
isPortOpen(Host,Port);
code: |
const redis = require('nuclei/redis');
const info = redis.GetServerInfo(Host,Port);
Export(info);
args:
Host: "{{Host}}"
Port: "6379"
matchers:
- type: dsl
dsl:
- success == true
- compare_versions(version, ' < 8.2.2')
condition: and
extractors:
- type: regex
name: version
part: response
group: 1
regex:
- redis_version:(\d+\.\d+\.\d+)
- code: |
const redis = require('nuclei/redis');
const info = redis.RunLuaScript(Host,Port,Password,Payload);
Export(info);
args:
Host: "{{Host}}"
Port: "6379"
Password: "{{passwords}}"
Payload: 'return "lua enabled"'
payloads:
passwords:
- ""
matchers:
- type: dsl
dsl:
- success == true
- contains(response, 'lua enabled')
condition: and
internal: true
# digest: 490a00463044022038c61354e8bb545b853ae78995deb3430115da9f6940ca52252e61014377f60e022047b4b429e04e7ff07164acf4e23ff03a792894bb2a3000a6bb6150543cadbf07:922c64590222798bb761d5b6d8e72950
Remediation & Mitigation
Immediate Actions:
- Patch: Upgrade all Redis instances to version 8.2.2 or later.
- Workaround: If patching is not immediately possible, restrict Lua script execution using ACLs:
ACL SETUSER <username> -EVAL -FUNCTION - Network Access: Ensure Redis is not exposed to untrusted networks. Use firewalls to restrict access to port 6379.
Long-Term Measures:
- Implement a vulnerability management program to ensure timely patching.
- Monitor for new CVEs affecting Redis and other critical infrastructure.
- Use network segmentation and least-privilege principles for all services.
Valters IT
{/* [Security Hash: EF9523AC3DCC93AAD5F335BF] */}