CVE-2025-46819

What it actually does

An authenticated user can supply a malicious Lua script that performs an out-of-bounds memory read or triggers a crash through insufficient bounds checking in Lua script handling present in all Redis versions with Lua scripting enabled.

Why it matters to the business

Redis deployments face denial-of-service outages and possible memory disclosure that can interrupt dependent applications and services; the presence of weaponized exploits and named threat actor activity increases urgency for organizations relying on Redis.

How an attack unfolds

An attacker with valid Redis credentials crafts a malicious Lua script and submits it using EVAL or FUNCTION commands; the script triggers memory corruption leading to data leakage or server crash. Groups associated with RediShell and related Redis RCE campaigns have been observed leveraging similar techniques.

How to fix it

Upgrade redis/redis to the fixed commit 9829bdbfd9e7eeb8fb6c79ce36bcc77a681824b1 (version 8.2.2) or later. As a workaround without patching, apply ACL rules that block both the EVAL and FUNCTION command families for untrusted users.

How to confirm the fix worked

Confirm the running Redis binary reports version 8.2.2 or newer; verify ACL policies restrict EVAL and FUNCTION when the workaround is used; attempt controlled Lua execution to ensure crashes no longer occur.

Typical attack path

1. Obtain valid Redis credentials
2. Prepare a specially crafted Lua script
3. Submit the script via EVAL or FUNCTION commands
4. Trigger out-of-bounds read or server crash resulting in denial of service

How to detect it

Review Redis logs for repeated or anomalous EVAL and FUNCTION command usage; correlate with known threat actor patterns such as RediShell activity; inspect for unexpected process restarts or Lua-related crashes after script execution.

What your security team should do

• Upgrade all Redis instances to the fixed version immediately
• Apply ACL restrictions on Lua commands until patching is complete
• Audit Redis access controls and remove unnecessary script execution privileges
• Monitor Redis logs and process behavior for Lua-related anomalies