Skip to main content

Out-of-bounds Read

CVE-2025-46819

High
7.1/10

Summary

Redis is an open source, in-memory database that persists on disk. An authenticated user uses a specially crafted LUA script to read out-of-bound data or crash the server and subsequent denial of service. The problem exists in all versions of Redis with Lua scripting. To work around this issue without patching the redis-server executable, it is to prevent users from executing Lua scripts. This can be done using ACL to block a script by restricting both the EVAL and FUNCTION command families. This issue affects redis versions through 6.2.19, 7.0-rc1 through 7.2.10, 7.4-rc1 through 7.4.5, 8.0-m01 through 8.0.3, 8.2-m01-int through 8.2.2-int, and 8.4-m01-int through 8.4-rc1-int and 8.4-rc1.

  • LOW
  • LOCAL
  • NONE
  • UNCHANGED
  • NONE
  • LOW
  • HIGH
  • HIGH

CWE-125 - Out-of-Bounds Read

Out-of-bounds read is a vulnerability that allows access to memory beyond the authorized accessible location. Such a vulnerability compromises the confidentiality of the trusted environment in the application and enables an attacker to launch further attacks by leveraging the exposed information.

References

Advisory Timeline

  • Published