GCVE-110-NCSC-2025-304

Advisory PublishedCVSS 9.9/10

Vulnetix · Advisory published October 8, 2025

Redis versions 8.2.1 and below contain a vulnerability in the Lua scripting engine that can be exploited by authenticated users, potentially leading to remote code execution, which is addressed in version 8.2.2.

Download JSON Open in Console

Weaknesses (CWE)

CWE-416Use After FreeCWE-190Integer Overflow or WraparoundCWE-94Improper Control of Generation of Code ('Code Injection')

Risk Scores

CVSS 3.1

9.9/10

Critical · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
Redis	vers:unknown/*	—	—
Open Source	vers:unknown/*	—	—

Aliases

CVE-2025-46817 CVE-2025-46818 CVE-2025-46819 CVE-2025-49844

References

advisory

Browse GCVE Records

73,834 records in the GCVE database · Updated July 19, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON