Most recent entries from all

ALSA-2025:19237 — Important: redis security update

Affected: AlmaLinux:9: redis, AlmaLinux:9: redis-devel, AlmaLinux:9: redis-doc

Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, or by appending each command to a log.

Security Fix(es):

* redis: Lua library commands may lead to integer overflow and potential RCE (CVE-2025-46817) * Redis: Redis: Authenticated users can execute LUA scripts as a different user (CVE-2025-46818) * Redis: Redis is vulnerable to DoS via specially crafted LUA scripts (CVE-2025-46819) * Redis: Redis Lua Use-After-Free may lead to remote code execution (CVE-2025-49844)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2025-12820

BELL-CVE-2025-46817

Affected: Alpaquita:23: redis, Alpaquita:25: redis, Alpaquita:stream: redis

BIT-keydb-2025-46817 — Lua library commands may lead to integer overflow and potential RCE

Affected: Bitnami: keydb

Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to cause an integer overflow and potentially lead to remote code execution The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2.

certfr-2025-avi-0899 — De multiples vulnérabilités ont été découvertes dans les produits Microsoft. Certaines d'entre elles permettent à un at…

certfr-2025-avi-0899

Withdrawn: CLEANSTART-2026-AF35851 — Redis is an open source, in-memory database that persists on disk

Withdrawn by the publisher.

Affected: CleanStart: redis

Multiple security vulnerabilities affect the redis package. Redis is an open source, in-memory database that persists on disk. See references for individual vulnerability details.

EUVD-2026-254121

fkie_cve-2025-46817

ICSA-26-083-03 — "Schneider Electric Plant iT/Brewmaxx"

Schneider Electric is aware of multiple vulnerabilities in Redis open-source database, affecting its Plant iT product. The [Plant iT/Brewmaxx](https://www.proleit.com/plant-it/) product is an object-oriented and PLC-based process control system with integrated Manufacturing Execution System functionality. The integrated and modular software platform consists of basic systems, modules and add-ons that can be flexibly combined. Failure to apply the remediations provided below may risk privilege escalation, which could result in remote code execution.

msrc_CVE-2025-46817 — Lua library commands may lead to integer overflow and potential RCE

msrc_CVE-2025-46817

OESA-2025-2389 — redis security update

Affected: openEuler:24.03-LTS-SP2: redis

Redis is an advanced key-value store. It is often referred to as a dattructure server since keys can contain strings, hashes ,lists, sets anorted sets. Security Fix(es):

Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to cause an integer overflow and potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2.(CVE-2025-46817)

Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate different LUA objects and potentially run their own code in the context of another user. The problem exists in all versions of Redis with LUA scripting. This issue is fixed in version 8.2.2. A workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing LUA scripts. This can be done using ACL to block a script by restricting both the EVAL and FUNCTION command families.(CVE-2025-46818)

Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted LUA script to read out-of-bound data or crash the server and subsequent denial of service. The problem exists in all versions of Redis with Lua scripting.(CVE-2025-46819)

An authenticated user may use a specia…

openSUSE-SU-2025:15600-1 — redis-8.2.2-1.1 on GA media

redis-8.2.2-1.1 on GA media

RHSA-2025:18931 — Red Hat Security Advisory: redis:7 security update

redis: Lua library commands may lead to integer overflow and potential RCE Redis: Redis Lua Use-After-Free may lead to remote code execution

SEVD-2026-013-01 — Multiple Third-Party Vulnerabilities on ProLeiT Plant iT/Brewmaxx

SUSE-SU-2025:03499-1 — Security update for valkey

Security update for valkey

UBUNTU-CVE-2025-46817

Affected: Ubuntu:24.04:LTS: valkey, Ubuntu:25.10: redict, Ubuntu:25.10: valkey, Ubuntu:26.04:LTS: redict

VDE-2026-064 — METTLER TOLEDO: LabX Standard Report on External Component Analysis - v21.3

Multiple vulnerabilities have been discovered in LabX Standard v21.3.22. Most of the vulnerabilities are fixed in LabX Standard v21.4.23. The Vulnerabilities CVE-2025-69419, CVE-2026-0915, CVE-2025-15467 and CVE-2025-58187 are not yet fixed. The fix will be available in the upcoming releases.

Notice: LabX Standard was formerly known as LabX Cloud Local.

WID-SEC-W-2025-2196 — Redis: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Redis ausnutzen, um beliebigen Programmcode auszuführen, um Daten zu manipulieren, um einen Denial of Service Angriff durchzuführen, und um Informationen offenzulegen.