CVE-2025-46819

{"id": "CVE-2025-46819", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-46819", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-03T19:24:17.581618Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.0}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "redis", "product": "redis", "versions": [{"status": "affected", "version": "< 8.2.2"}]}]}], "published": "2025-10-03T19:15:43.490", "references": [{"url": "https://github.com/redis/redis/commit/3a1624da2449ac3dbfc4bdaed43adf77a0b7bfba", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/redis/redis/releases/tag/8.2.2", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/redis/redis/security/advisories/GHSA-4c68-q8q8-3g4f", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://www.vicarius.io/vsociety/posts/cve-2025-46819-detect-redis-vulnerability", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.vicarius.io/vsociety/posts/cve-2025-46819-mitigate-redis-vulnerability", "tags": ["Mitigation", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-190"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted LUA script to read out-of-bound data or crash the server and subsequent denial of service. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to block a script by restricting both the EVAL and FUNCTION command families."}, {"lang": "es", "value": "Redis es una base de datos en memoria, de c\u00f3digo abierto, que persiste en disco. Las versiones 8.2.1 e inferiores permiten a un usuario autenticado usar un script LUA especialmente dise\u00f1ado para leer datos fuera de l\u00edmites o bloquear el servidor y la subsiguiente denegaci\u00f3n de servicio. El problema existe en todas las versiones de Redis con scripting Lua. Este problema est\u00e1 solucionado en la versi\u00f3n 8.2.2. Para solucionar este problema sin parchear el ejecutable redis-server es evitar que los usuarios ejecuten scripts Lua. Esto se puede hacer usando ACL para bloquear un script restringiendo tanto las familias de comandos EVAL como FUNCTION."}], "lastModified": "2026-10-19T17:10:00.173", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C2F4D4F6-6F7C-46BC-B37C-DFAC34B097AC", "versionEndExcluding": "6.2.20"}, {"criteria": "cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4F82BD2A-473F-4F3F-9C80-C6448D07C45D", "versionEndExcluding": "7.2.11", "versionStartIncluding": "7.0"}, {"criteria": "cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F6E336B8-E000-4EFA-95F8-F2B74A4913F0", "versionEndExcluding": "7.4.6", "versionStartIncluding": "7.4.0"}, {"criteria": "cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "459EBC07-D37A-44E5-95DB-4C3FD9F008FF", "versionEndExcluding": "8.0.4", "versionStartIncluding": "8.0.0"}, {"criteria": "cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CBF13EC1-FE0A-4242-B8D3-2681485DDDF2", "versionEndExcluding": "8.2.2", "versionStartIncluding": "8.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}