{"id":"CVE-2025-46818","summary":"Redis: Authenticated users can execute LUA scripts as a different user","details":"Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate different LUA objects and potentially run their own code in the context of another user. The problem exists in all versions of Redis with LUA scripting. This issue is fixed in version 8.2.2. A workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing LUA scripts. This can be done using ACL to block a script by restricting both the EVAL and FUNCTION command families.","aliases":["BIT-keydb-2025-46818","BIT-redis-2025-46818","BIT-valkey-2025-46818","GHSA-qrv7-wcrx-q5jp"],"modified":"2026-09-12T14:19:15.444756Z","published":"2025-10-03T18:38:57.170Z","related":["ALSA-2025:19237","ALSA-2025:19238","ALSA-2025:19345","ALSA-2025:19675","ALSA-2025:20926","ALSA-2025:20955","ALSA-2025:21916","ALSA-2025:21936","SUSE-SU-2025:03499-1","SUSE-SU-2025:03500-1","SUSE-SU-2025:03501-1","SUSE-SU-2025:03502-1","SUSE-SU-2025:03505-1","SUSE-SU-2025:03506-1","SUSE-SU-2025:03507-1","SUSE-SU-2026:20022-1","openSUSE-SU-2025:15600-1","openSUSE-SU-2025:15604-1","openSUSE-SU-2025:20121-1","openSUSE-SU-2026:20003-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/46xxx/CVE-2025-46818.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-94"]},"references":[{"type":"WEB","url":"https://github.com/redis/redis/releases/tag/8.2.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/46xxx/CVE-2025-46818.json"},{"type":"ADVISORY","url":"https://github.com/redis/redis/security/advisories/GHSA-qrv7-wcrx-q5jp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-46818"},{"type":"FIX","url":"https://github.com/redis/redis/commit/45eac0262028c771b6f5307372814b75f49f7a9e"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/redis/redis","events":[{"introduced":"0"},{"fixed":"86b64d6098b3cfb839ab9a65e0104c840c696eee"},{"introduced":"d375595d5e3ae2e5c29e6c00a2dc3d60578fd9fc"},{"fixed":"d4c381df7a729c06a5207c4f18d804febe956dc4"},{"introduced":"c9d29f6a918c335bc1778d9f68e521c1bbb36a0f"},{"fixed":"4b03ddfdac5a5c007358df8d08873f508f2fbfe3"},{"introduced":"e91a340e241cf0abe3c6a0c254214fbe4aa1d95f"},{"fixed":"0ebb3381cd146c45f4ea14d5999d257a1649221d"},{"introduced":"4fa8bf356b4bf0f1ce345286a4f02d022a4badcb"},{"fixed":"9829bdbfd9e7eeb8fb6c79ce36bcc77a681824b1"},{"fixed":"45eac0262028c771b6f5307372814b75f49f7a9e"}],"database_specific":{"cpe":"cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"6.2.20"},{"introduced":"7.0"},{"fixed":"7.2.11"},{"introduced":"7.4.0"},{"fixed":"7.4.6"},{"introduced":"8.0.0"},{"fixed":"8.0.4"},{"introduced":"8.2.0"},{"fixed":"8.2.2"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["8.2.2-int","6.2.19","8.0.3","8.2.1","8.2.1-int","7.2.10","8.2.0","7.4.5","7.2.9","6.2.18","7.4.4","8.0.2","8.0.1","7.2.8","7.4.3","8.0.1-int","8.0.0","7.4.2","7.2.7","6.2.17","7.2.6","7.4.1","6.2.16","6.2.15","6.2.14","7.4.0","7.2.5","7.2.4","7.2.3","7.2.2","7.2.1","6.2.13","7.2.0","7.2-rc3","7.2-rc2","6.2.12","7.2-rc1","6.2.11","6.2.10","6.2.9","6.2.8","6.2.7","6.2.6","6.2.5","6.2.4","6.2.3","6.2.2","6.2.1","6.2.0","6.2-rc3","6.2-rc2","6.2-rc1","2.3-alpha0","2.2.0-rc1","2.2-alpha6","2.2-alpha5","2.2-alpha4","2.2-alpha3","2.2-alpha2","2.2-alpha1","2.2-alpha0","v2.0.0-rc1","v2.1.1-watch","v1.3.11","v1.3.10","v1.3.9","v1.3.8","v1.3.7","1.3.6","vm-playpen"],"database_specific":{"vanir_signatures_modified":"2026-09-12T14:19:15Z","vanir_signatures":[{"source":"https://github.com/redis/redis/commit/45eac0262028c771b6f5307372814b75f49f7a9e","target":{"file":"src/server.h"},"deprecated":false,"digest":{"line_hashes":["107260277334791782489294469421831164590","185949499143751050673218066351018002844","38129139052985699888342736274176459700","104511318116477423509510060214967499106"],"threshold":0.9},"id":"CVE-2025-46818-0e6fa3ef","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/redis/redis/commit/9829bdbfd9e7eeb8fb6c79ce36bcc77a681824b1","target":{"file":"src/defrag.c","function":"defragStream"},"deprecated":false,"digest":{"function_hash":"231823367469822555940742382288933873230","length":564},"id":"CVE-2025-46818-1bff8e25","signature_type":"Function","signature_version":"v1"},{"target":{"file":"src/defrag.c","function":"defragStreamConsumerGroup"},"deprecated":false,"digest":{"function_hash":"288446850232562980440863683026214219231","length":274},"id":"CVE-2025-46818-2f43472c","signature_type":"Function","signature_version":"v1","source":"https://github.com/redis/redis/commit/9829bdbfd9e7eeb8fb6c79ce36bcc77a681824b1"},{"digest":{"line_hashes":["122476730971627598082987544893949952690","316402332071314090157620944369991822065","174639425452451605438039526884324770499","176600052128780203810844530404018188458","301309262122758822897019105310558043754","299354253581814511690527914483266701365","115362364653292868870372836877867862481","320733822444882182265584870605193257625","5849346950572367809069542175033591715","214227539120788277299835737477614552993","292617117293088753834831088124062169300","269119900664057169438814555210660231822","163999315846980596891505991183574140877","138570398397428884262291440992327518564","140099108494593051722349534291078949122","99992088134972751076833113454613708094","157467505993493623440073287590282731464","323748931374680285492559419747044336551","240565023600621945201382043922054672219","262559147118934924438178173624759544199","67221112944876416433165123682952065048","177759301566905712791273401093366204821","306537199264393398708067899431560318026","281858496607878993098887440414340276315","6387080263974173823416316868479044198","23127228174809201836487005474988852864","212366233278189967159203547304878645054","141037630150008497421009888210963153260","307153258789790523268722464164260033740"],"threshold":0.9},"id":"CVE-2025-46818-37c68165","signature_type":"Line","signature_version":"v1","source":"https://github.com/redis/redis/commit/45eac0262028c771b6f5307372814b75f49f7a9e","target":{"file":"src/script_lua.c"},"deprecated":false},{"id":"CVE-2025-46818-50c553aa","signature_type":"Function","signature_version":"v1","source":"https://github.com/redis/redis/commit/45eac0262028c771b6f5307372814b75f49f7a9e","target":{"file":"src/script_lua.c","function":"luaNewIndexAllowList"},"deprecated":false,"digest":{"function_hash":"107512873654665278113400660035271736896","length":1117}},{"id":"CVE-2025-46818-69a4e202","signature_type":"Function","signature_version":"v1","source":"https://github.com/redis/redis/commit/45eac0262028c771b6f5307372814b75f49f7a9e","target":{"file":"src/eval.c","function":"scriptingInit"},"deprecated":false,"digest":{"function_hash":"190498972059526767610801452638715721338","length":2083}},{"deprecated":false,"digest":{"function_hash":"269273620982420028349368441170132491277","length":316},"id":"CVE-2025-46818-77eb7a7a","signature_type":"Function","signature_version":"v1","source":"https://github.com/redis/redis/commit/9829bdbfd9e7eeb8fb6c79ce36bcc77a681824b1","target":{"file":"src/defrag.c","function":"defragStreamConsumerPendingEntry"}},{"target":{"file":"src/script_lua.h"},"deprecated":false,"digest":{"line_hashes":["165970070594782698251956298752646187208","203916906900106641720718917493709156524","73580233193742422415850924087594281694","266512115775491320939236233502323590925"],"threshold":0.9},"id":"CVE-2025-46818-78857045","signature_type":"Line","signature_version":"v1","source":"https://github.com/redis/redis/commit/45eac0262028c771b6f5307372814b75f49f7a9e"},{"target":{"file":"src/ebuckets.c","function":"ebDefragRaxBucket"},"deprecated":false,"digest":{"function_hash":"278644848284550820802314798222846137842","length":1028},"id":"CVE-2025-46818-90636aee","signature_type":"Function","signature_version":"v1","source":"https://github.com/redis/redis/commit/9829bdbfd9e7eeb8fb6c79ce36bcc77a681824b1"},{"signature_version":"v1","source":"https://github.com/redis/redis/commit/9829bdbfd9e7eeb8fb6c79ce36bcc77a681824b1","target":{"file":"src/defrag.c"},"deprecated":false,"digest":{"line_hashes":["138051693839747285096021458702403893111","217792725282971082265874066493719589089","314104092114484613540366304337620153799","289838893004834880788220210160086127357","261640981466269970594854736063516974006","310366546339259136490471016273997718966","32133616761046458240624936400794999717","99379125398230922191097416962833631765","141940563608976522218604452044168104567","11220539234012554404348468137403013259","232481408480410736814504528475544114533","51866787026042368566811775065054533143","63433160957720909299274972010261027892","294256383012553041837446580576855146212","89382824653771948252974872163098475979","125843216691037721002607267089725657746","134688872856233222990888740724026394481","48326925826003410695033980425698456909","67996540693667022215470987524713099413","136018837045987266595679134463638862968","333375019022085398980596780008619891568","29915176327139359699601310212482016515","78998988978891701179665002117073134153","17549832641806627852119609812055732197","42446296350911664275182979645220907226","138975645959192329129097852787418759626","149158348708285902087935202222825724476","142605691491218526884160292427755441470","11688604414306184430853572012154672997","148558868641076683043063174755617384651","21028590655927164121484625827791262156","46089719024847428095945812658394875858","132152125759967892984304802846013499407","252710555466710673955941017321669831749","239262572873833474405578058531672783359","66720547795711375935066349761282397334","228824034014002333793286778567671435553","140423370034328928159919286536412352374","34259259009794645587500028432093165186","32714089352387174407290605263289841726","142160850842147572350805881228483295868","232067484793209163755223773554912439711","294077731618297973044671231562754097105","216744741664175839129273154417262477100","995446791351321522154638928135859875","191256389506455193250670539930255527581","302732920957766076804960979292947649450","26025635131505467470119512320366390742"],"threshold":0.9},"id":"CVE-2025-46818-9771037c","signature_type":"Line"},{"source":"https://github.com/redis/redis/commit/45eac0262028c771b6f5307372814b75f49f7a9e","target":{"file":"src/config.c"},"deprecated":false,"digest":{"line_hashes":["91003600176322614192026479863571246173","339784128995344950459065155956636536880","126207912594636408677887389813431305506","288230584928740147940081202140810302603"],"threshold":0.9},"id":"CVE-2025-46818-a01a0bfb","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/redis/redis/commit/45eac0262028c771b6f5307372814b75f49f7a9e","target":{"function":"luaEngineInitEngine","file":"src/function_lua.c"},"deprecated":false,"digest":{"function_hash":"183709879280770073736571958687704896612","length":2664},"id":"CVE-2025-46818-a19023a7","signature_type":"Function"},{"digest":{"line_hashes":["244502848865928883332908724730119052311","141797934241402737746765354854429761657","121189225860232617002299124820059699861","325221416935840389820722274695630580016","303490719280172131208887830823944185073","43864785869962988976065089075595503762","53490938445701540411614375924248395921","23408075982072842741195268914820996812","320872889493649556307334100222506094780","244730142365431892013328866901959544225","170283847187515741955371454705299138105","235864933409515329941478345542925607458"],"threshold":0.9},"id":"CVE-2025-46818-b3bba80f","signature_type":"Line","signature_version":"v1","source":"https://github.com/redis/redis/commit/9829bdbfd9e7eeb8fb6c79ce36bcc77a681824b1","target":{"file":"src/ebuckets.c"},"deprecated":false},{"source":"https://github.com/redis/redis/commit/45eac0262028c771b6f5307372814b75f49f7a9e","target":{"file":"src/eval.c"},"deprecated":false,"digest":{"line_hashes":["46694226370122295628316153899228051142","273883128858113296496190780332231730281","154768320951593076946470836048419776555","93545321639237415795288307408962934926"],"threshold":0.9},"id":"CVE-2025-46818-b4169be5","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["313312299792952417191224374761902426256","288490776890570573958342776010300826853","103179375797816145395198418482185777382"],"threshold":0.9},"id":"CVE-2025-46818-b44cc0d4","signature_type":"Line","signature_version":"v1","source":"https://github.com/redis/redis/commit/45eac0262028c771b6f5307372814b75f49f7a9e","target":{"file":"src/function_lua.c"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/redis/redis/commit/9829bdbfd9e7eeb8fb6c79ce36bcc77a681824b1","target":{"file":"src/defrag.c","function":"activeDefragAlloc"},"deprecated":false,"digest":{"function_hash":"43521981978878587750908260601344872279","length":307},"id":"CVE-2025-46818-c715e681"},{"deprecated":false,"digest":{"function_hash":"307600606145985118090248030247413925373","length":654},"id":"CVE-2025-46818-f6afd884","signature_type":"Function","signature_version":"v1","source":"https://github.com/redis/redis/commit/9829bdbfd9e7eeb8fb6c79ce36bcc77a681824b1","target":{"file":"src/defrag.c","function":"activeDefragHExpiresOB"}}],"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-46818.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N"}]}