Redis < 8.2.1 lua script - Integer Overflow

披露于 2025/10/03 · 更新于 2026/10/03

CVSS 评分8.8/ 10.0

EPSS 概率3.8%百分位 89.8%

漏洞描述

Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to cause an integer overflow and potentially lead to remote code execution The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2.

影响产品

redisRedis查看产品 →

修复建议

建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。

参考链接

github.comhttps://github.com/redis/redis/security/advisories/GHSA-m8fj-85cg-7vhp↗github.comhttps://github.com/redis/redis/commit/fc9abc775e308374f667fdf3e723ef4b7eb0e3ca↗github.comhttps://github.com/redis/redis/releases/tag/8.2.2↗

RELATED INTELLIGENCE

同产品关联漏洞

与 Redis 相关的其他公开漏洞。

查看全部 →

漏洞与影响对象	漏洞类型	风险等级	CVSS	EPSS	PoC 状态	披露时间
Redis Info - Detect Redis	信息泄露	低危	—	—	PoC	2026/01/12
CVE-2025-49844RCE Redis Lua Parser < 8.2.2 - Use After Free Redis	使用后释放	严重	9.9	82.3%	PoC	2025/10/03
CVE-2025-46818RCE Redis Lua Sandbox < 8.2.2 - Cross-User Escape Redis	远程代码执行	高危	7.3	0.73%	PoC	2025/10/03
CVE-2025-46819 Redis < 8.2.1 Lua Long-String Delimiter - Out-of-Bounds Read Redis	整数溢出	高危	7.1	1.1%	PoC	2025/10/03
Redis - Default Logins Redis	安全配置错误	高危	—	—	PoC	2024/07/10
Redis Server - Unauthenticated Access Redis	未授权访问	高危	7.2	—	PoC	2024/06/08