CVE catalog

CVE-2025-46817

Valkey vulnerabilities

[CVE catalog]

Severity
High · CVSS 8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
3.92% · Oct 25, 2026

Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to cause an integer overflow and potentially lead to remote code execution The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianredissid5:8.0.6-3fixed
Debianredisforky5:8.0.6-3fixed
Debianredistrixie5:8.0.2-3+deb13u2fixed
Debianredistrixie-security5:8.0.2-3+deb13u3fixed
Debianredisbookworm5:7.0.15-1~deb12u7fixed
Debianredisbookworm-security5:7.0.15-1~deb12u10fixed
Ubuntuvalkeynoble7.2.11+dfsg1-0ubuntu0.2fixed
Ubuntuvalkey-redis-compatnoble7.2.11+dfsg1-0ubuntu0.2fixed
Ubuntuvalkey-sentinelnoble7.2.11+dfsg1-0ubuntu0.2fixed
Ubuntuvalkey-servernoble7.2.11+dfsg1-0ubuntu0.2fixed
Ubuntuvalkey-toolsnoble7.2.11+dfsg1-0ubuntu0.2fixed
CperedisNot reported8.2.2fixed
Alpinevalkey3.207.2.11-r0fixed
Alpinevalkey3.217.2.11-r0fixed
Alpinevalkey3.228.1.4-r0fixed
Alpinevalkey3.238.1.4-r0fixed
Alpinevalkey3.248.1.4-r0fixed
Ubuntuvalkey24.047.2.5+dfsg1-2ubuntu4~24.04.1vulnerable
Ubuntuvalkey24.047.2.7+dfsg1-0ubuntu0.24.04.1vulnerable
Ubuntuvalkey24.047.2.8+dfsg1-0ubuntu0.24.04.1vulnerable
Ubuntuvalkey24.047.2.8+dfsg1-0ubuntu0.24.04.2vulnerable
Ubuntuvalkey24.047.2.8+dfsg1-0ubuntu0.24.04.3vulnerable
Ubuntuvalkey24.047.2.10+dfsg1-0ubuntu0.1vulnerable
Ubuntuvalkey24.047.2.11+dfsg1-0ubuntu0.1vulnerable
Ubuntuvalkey24.047.2.11+dfsg1-0ubuntu0.2fixed
Ubuntuvalkey25.108.0.2+dfsg1-1ubuntu1vulnerable
Ubuntuvalkey25.108.1.1+dfsg1-2ubuntu1vulnerable
Ubuntuvalkey25.108.1.3+dfsg1-0ubuntu1vulnerable
Ubuntuvalkey25.108.1.3+dfsg1-0ubuntu2vulnerable
Ubuntuvalkey25.108.1.4+dfsg1-0ubuntu0.1vulnerable
Ubuntuvalkey25.108.1.4+dfsg1-0ubuntu0.2fixed
Opensusevalkeyleap 16.08.0.6-160000.1.1fixed
Opensuseredisleap 16.08.2.3-bp160.1.1fixed
Opensusevalkeytumbleweed8.1.4-1.1fixed
Opensuseredistumbleweed8.2.2-1.1fixed
Susevalkeylinux enterprise server 16.08.0.6-160000.1.1fixed
Susevalkeylinux enterprise server for sap applications 16.08.0.6-160000.1.1fixed
Suseredislinux enterprise high performance computing 15 sp4-espos6.2.6-150400.3.40.1fixed
Suseredislinux enterprise high performance computing 15 sp4-ltss6.2.6-150400.3.40.1fixed
Suseredislinux enterprise high performance computing 15 sp5-espos6.2.6-150400.3.40.1fixed
Suseredislinux enterprise high performance computing 15 sp5-ltss6.2.6-150400.3.40.1fixed
Suseredislinux enterprise server 15 sp4-ltss6.2.6-150400.3.40.1fixed
Suseredislinux enterprise server 15 sp5-ltss6.2.6-150400.3.40.1fixed
Suseredislinux enterprise server for sap applications 15 sp46.2.6-150400.3.40.1fixed
Suseredislinux enterprise server for sap applications 15 sp56.2.6-150400.3.40.1fixed
Suseredismanager proxy lts 4.36.2.6-150400.3.40.1fixed
Suseredismanager server lts 4.36.2.6-150400.3.40.1fixed
Susevalkeylinux enterprise module for server applications 15 sp78.0.6-150700.3.11.1fixed
Suseredis7linux enterprise high performance computing 15 sp5-espos7.0.8-150500.3.24.1fixed
Suseredis7linux enterprise high performance computing 15 sp5-ltss7.0.8-150500.3.24.1fixed
Suseredis7linux enterprise server 15 sp5-ltss7.0.8-150500.3.24.1fixed
Suseredis7linux enterprise server for sap applications 15 sp57.0.8-150500.3.24.1fixed
Susevalkeylinux enterprise module for server applications 15 sp68.0.6-150600.13.17.1fixed
Opensusevalkeyleap 15.68.0.6-150600.13.17.1fixed
Suseredis7linux enterprise module for server applications 15 sp67.0.8-150600.8.19.1fixed
Opensuseredis7leap 15.67.0.8-150600.8.19.1fixed
Suseredislinux enterprise high performance computing 15 sp3-ltss6.0.14-150200.6.43.1fixed
Suseredislinux enterprise server 15 sp3-ltss6.0.14-150200.6.43.1fixed
Suseredislinux enterprise server for sap applications 15 sp36.0.14-150200.6.43.1fixed
Suseredisenterprise storage 7.16.0.14-150200.6.43.1fixed
Suseredislinux enterprise module for server applications 15 sp67.2.4-150600.3.18.1fixed
Opensuseredisleap 15.67.2.4-150600.3.18.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianredissourcesid5:8.0.4-1not yet assignedNot reported[1117553]
Debianredissourceforky5:8.0.4-1not yet assignedNot reported[1117553]
Debianredissourcetrixie5:8.0.2-3+deb13u1not yet assignedNot reported[1117553]
Debianredissourcebookworm5:7.0.15-1~deb12u6not yet assignedNot reported[1117553]
Ubuntuvalkeydebnoble7.2.11+dfsg1-0ubuntu0.2Not reportedNot reportedNot reported
Ubuntuvalkey-redis-compatdebnoble7.2.11+dfsg1-0ubuntu0.2Not reportedNot reportedNot reported
Ubuntuvalkey-sentineldebnoble7.2.11+dfsg1-0ubuntu0.2Not reportedNot reportedNot reported
Ubuntuvalkey-serverdebnoble7.2.11+dfsg1-0ubuntu0.2Not reportedNot reportedNot reported
Ubuntuvalkey-toolsdebnoble7.2.11+dfsg1-0ubuntu0.2Not reportedNot reportedNot reported
CperediscpeNot reported8.2.2Not reportedNVD-CVE-2025-46817Not reported
Alpinevalkeyapk3.207.2.11-r0Not reportedALPINE-CVE-2025-46817Not reported
Alpinevalkeyapk3.217.2.11-r0Not reportedALPINE-CVE-2025-46817Not reported
Alpinevalkeyapk3.228.1.4-r0Not reportedALPINE-CVE-2025-46817Not reported
Alpinevalkeyapk3.238.1.4-r0Not reportedALPINE-CVE-2025-46817Not reported
Alpinevalkeyapk3.248.1.4-r0Not reportedALPINE-CVE-2025-46817Not reported
Ubuntuvalkeydeb24.047.2.11+dfsg1-0ubuntu0.2Not reportedUSN-7893-1Not reported
Ubuntuvalkeydeb25.108.1.4+dfsg1-0ubuntu0.2Not reportedUSN-7893-1Not reported
Opensusevalkeyrpmleap 16.08.0.6-160000.1.1Not reportedOPENSUSE-SU-2026:20003-1Not reported
Opensuseredisrpmleap 16.08.2.3-bp160.1.1Not reportedOPENSUSE-SU-2025:20121-1Not reported
Opensusevalkeyrpmtumbleweed8.1.4-1.1Not reportedOPENSUSE-SU-2025:15604-1Not reported
Opensuseredisrpmtumbleweed8.2.2-1.1Not reportedOPENSUSE-SU-2025:15600-1Not reported
Susevalkeyrpmlinux enterprise server 16.08.0.6-160000.1.1Not reportedSUSE-SU-2026:20022-1Not reported
Susevalkeyrpmlinux enterprise server for sap applications 16.08.0.6-160000.1.1Not reportedSUSE-SU-2026:20022-1Not reported
Suseredisrpmlinux enterprise high performance computing 15 sp4-espos6.2.6-150400.3.40.1Not reportedSUSE-SU-2025:03506-1Not reported
Suseredisrpmlinux enterprise high performance computing 15 sp4-ltss6.2.6-150400.3.40.1Not reportedSUSE-SU-2025:03506-1Not reported
Suseredisrpmlinux enterprise high performance computing 15 sp5-espos6.2.6-150400.3.40.1Not reportedSUSE-SU-2025:03506-1Not reported
Suseredisrpmlinux enterprise high performance computing 15 sp5-ltss6.2.6-150400.3.40.1Not reportedSUSE-SU-2025:03506-1Not reported
Suseredisrpmlinux enterprise server 15 sp4-ltss6.2.6-150400.3.40.1Not reportedSUSE-SU-2025:03506-1Not reported
Suseredisrpmlinux enterprise server 15 sp5-ltss6.2.6-150400.3.40.1Not reportedSUSE-SU-2025:03506-1Not reported
Suseredisrpmlinux enterprise server for sap applications 15 sp46.2.6-150400.3.40.1Not reportedSUSE-SU-2025:03506-1Not reported
Suseredisrpmlinux enterprise server for sap applications 15 sp56.2.6-150400.3.40.1Not reportedSUSE-SU-2025:03506-1Not reported
Suseredisrpmmanager proxy lts 4.36.2.6-150400.3.40.1Not reportedSUSE-SU-2025:03506-1Not reported
Suseredisrpmmanager server lts 4.36.2.6-150400.3.40.1Not reportedSUSE-SU-2025:03506-1Not reported
Susevalkeyrpmlinux enterprise module for server applications 15 sp78.0.6-150700.3.11.1Not reportedSUSE-SU-2025:03502-1Not reported
Suseredis7rpmlinux enterprise high performance computing 15 sp5-espos7.0.8-150500.3.24.1Not reportedSUSE-SU-2025:03501-1Not reported
Suseredis7rpmlinux enterprise high performance computing 15 sp5-ltss7.0.8-150500.3.24.1Not reportedSUSE-SU-2025:03501-1Not reported
Suseredis7rpmlinux enterprise server 15 sp5-ltss7.0.8-150500.3.24.1Not reportedSUSE-SU-2025:03501-1Not reported
Suseredis7rpmlinux enterprise server for sap applications 15 sp57.0.8-150500.3.24.1Not reportedSUSE-SU-2025:03501-1Not reported
Susevalkeyrpmlinux enterprise module for server applications 15 sp68.0.6-150600.13.17.1Not reportedSUSE-SU-2025:03499-1Not reported
Opensusevalkeyrpmleap 15.68.0.6-150600.13.17.1Not reportedSUSE-SU-2025:03499-1Not reported
Suseredis7rpmlinux enterprise module for server applications 15 sp67.0.8-150600.8.19.1Not reportedSUSE-SU-2025:03500-1Not reported
Opensuseredis7rpmleap 15.67.0.8-150600.8.19.1Not reportedSUSE-SU-2025:03500-1Not reported
Suseredisrpmlinux enterprise high performance computing 15 sp3-ltss6.0.14-150200.6.43.1Not reportedSUSE-SU-2025:03507-1Not reported
Suseredisrpmlinux enterprise server 15 sp3-ltss6.0.14-150200.6.43.1Not reportedSUSE-SU-2025:03507-1Not reported
Suseredisrpmlinux enterprise server for sap applications 15 sp36.0.14-150200.6.43.1Not reportedSUSE-SU-2025:03507-1Not reported
Suseredisrpmenterprise storage 7.16.0.14-150200.6.43.1Not reportedSUSE-SU-2025:03507-1Not reported
Suseredisrpmlinux enterprise module for server applications 15 sp67.2.4-150600.3.18.1Not reportedSUSE-SU-2025:03505-1Not reported
Opensuseredisrpmleap 15.67.2.4-150600.3.18.1Not reportedSUSE-SU-2025:03505-1Not reported

[Debian bug #1117553]

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • Source package: [valkey]

    Details (1)
    • 9.1.1-1.2 · noarch · tumbleweed

      Unknown · Fixed: 8.1.4-1.1

      Version impact unknown

      usn · valkey · opensuse · tumbleweed

  • [valkey-devel]Unknown

    Source package: [valkey]

    Details (1)
    • 9.1.1-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 8.1.4-1.1

      Version impact unknown

      usn · valkey · opensuse · tumbleweed

  • [redis]Fixed

    Source package: [redis]

    Details (1)
    • 8.10.1-1.1 · x86_64 · tumbleweed

      Fixed · Fixed: 8.2.2-1.1

      usn · redis · opensuse · tumbleweed

  • [valkey]Fixed

    Source package: [valkey]

    Details (1)
    • 9.1.1-1.2 · x86_64 · tumbleweed

      Fixed · Fixed: 8.1.4-1.1

      usn · valkey · opensuse · tumbleweed

[Debian 12 (Bookworm)]

  • [redis]Fixed
    Details (4)
    • 5:7.0.15-1~deb12u7 · all · bookworm

      Fixed · Fixed: 5:7.0.15-1~deb12u6

      usn · redis · debian · bookworm; usn · redis · debian · 12

    • 5:7.0.15-1~deb12u7 · all · bookworm

      Fixed · Fixed: 5:7.0.15-1~deb12u6

      usn · redis · debian · bookworm; usn · redis · debian · 12

    • 5:7.0.15-1~deb12u9 · all · bookworm-security

      Fixed · Fixed: 5:7.0.15-1~deb12u6

      usn · redis · debian · bookworm; usn · redis · debian · 12

    • 5:7.0.15-1~deb12u9 · all · bookworm-security

      Fixed · Fixed: 5:7.0.15-1~deb12u6

      usn · redis · debian · bookworm; usn · redis · debian · 12

  • Source package: [redis]

    Details (4)
    • 5:7.0.15-1~deb12u7 · amd64 · bookworm

      Fixed · Fixed: 5:7.0.15-1~deb12u6

      usn · redis · debian · bookworm; usn · redis · debian · 12

    • 5:7.0.15-1~deb12u7 · arm64 · bookworm

      Fixed · Fixed: 5:7.0.15-1~deb12u6

      usn · redis · debian · bookworm; usn · redis · debian · 12

    • 5:7.0.15-1~deb12u9 · amd64 · bookworm-security

      Fixed · Fixed: 5:7.0.15-1~deb12u6

      usn · redis · debian · bookworm; usn · redis · debian · 12

    • 5:7.0.15-1~deb12u9 · arm64 · bookworm-security

      Fixed · Fixed: 5:7.0.15-1~deb12u6

      usn · redis · debian · bookworm; usn · redis · debian · 12

  • Source package: [redis]

    Details (4)
    • 5:7.0.15-1~deb12u7 · amd64 · bookworm

      Fixed · Fixed: 5:7.0.15-1~deb12u6

      usn · redis · debian · bookworm; usn · redis · debian · 12

    • 5:7.0.15-1~deb12u7 · arm64 · bookworm

      Fixed · Fixed: 5:7.0.15-1~deb12u6

      usn · redis · debian · bookworm; usn · redis · debian · 12

    • 5:7.0.15-1~deb12u9 · amd64 · bookworm-security

      Fixed · Fixed: 5:7.0.15-1~deb12u6

      usn · redis · debian · bookworm; usn · redis · debian · 12

    • 5:7.0.15-1~deb12u9 · arm64 · bookworm-security

      Fixed · Fixed: 5:7.0.15-1~deb12u6

      usn · redis · debian · bookworm; usn · redis · debian · 12

  • Source package: [redis]

    Details (4)
    • 5:7.0.15-1~deb12u7 · amd64 · bookworm

      Fixed · Fixed: 5:7.0.15-1~deb12u6

      usn · redis · debian · bookworm; usn · redis · debian · 12

    • 5:7.0.15-1~deb12u7 · arm64 · bookworm

      Fixed · Fixed: 5:7.0.15-1~deb12u6

      usn · redis · debian · bookworm; usn · redis · debian · 12

    • 5:7.0.15-1~deb12u9 · amd64 · bookworm-security

      Fixed · Fixed: 5:7.0.15-1~deb12u6

      usn · redis · debian · bookworm; usn · redis · debian · 12

    • 5:7.0.15-1~deb12u9 · arm64 · bookworm-security

      Fixed · Fixed: 5:7.0.15-1~deb12u6

      usn · redis · debian · bookworm; usn · redis · debian · 12

[Debian 13 (Trixie)]

  • [redis]Fixed
    Details (5)
    • 5:8.0.2-3+deb13u2 · all · trixie

      Fixed · Fixed: 5:8.0.2-3+deb13u1

      usn · redis · debian · 13

    • 5:8.0.2-3+deb13u2 · all · trixie

      Fixed · Fixed: 5:8.0.2-3+deb13u1

      usn · redis · debian · 13

    • 5:8.0.2-3+deb13u2 · all · trixie-security · Historical version

      Fixed · Fixed: 5:8.0.2-3+deb13u1

      usn · redis · debian · 13

    • 5:8.0.2-3+deb13u2 · all · trixie-security

      Fixed · Fixed: 5:8.0.2-3+deb13u1

      usn · redis · debian · 13

    • 5:8.0.2-3+deb13u3 · all · trixie-security

      Fixed · Fixed: 5:8.0.2-3+deb13u1

      usn · redis · debian · 13

  • Source package: [redis]

    Details (5)
    • 5:8.0.2-3+deb13u2 · amd64 · trixie

      Fixed · Fixed: 5:8.0.2-3+deb13u1

      usn · redis · debian · 13

    • 5:8.0.2-3+deb13u2 · arm64 · trixie

      Fixed · Fixed: 5:8.0.2-3+deb13u1

      usn · redis · debian · 13

    • 5:8.0.2-3+deb13u2 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 5:8.0.2-3+deb13u1

      usn · redis · debian · 13

    • 5:8.0.2-3+deb13u2 · arm64 · trixie-security

      Fixed · Fixed: 5:8.0.2-3+deb13u1

      usn · redis · debian · 13

    • 5:8.0.2-3+deb13u3 · amd64 · trixie-security

      Fixed · Fixed: 5:8.0.2-3+deb13u1

      usn · redis · debian · 13

  • Source package: [redis]

    Details (5)
    • 5:8.0.2-3+deb13u2 · amd64 · trixie

      Fixed · Fixed: 5:8.0.2-3+deb13u1

      usn · redis · debian · 13

    • 5:8.0.2-3+deb13u2 · arm64 · trixie

      Fixed · Fixed: 5:8.0.2-3+deb13u1

      usn · redis · debian · 13

    • 5:8.0.2-3+deb13u2 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 5:8.0.2-3+deb13u1

      usn · redis · debian · 13

    • 5:8.0.2-3+deb13u2 · arm64 · trixie-security

      Fixed · Fixed: 5:8.0.2-3+deb13u1

      usn · redis · debian · 13

    • 5:8.0.2-3+deb13u3 · amd64 · trixie-security

      Fixed · Fixed: 5:8.0.2-3+deb13u1

      usn · redis · debian · 13

  • Source package: [redis]

    Details (5)
    • 5:8.0.2-3+deb13u2 · amd64 · trixie

      Fixed · Fixed: 5:8.0.2-3+deb13u1

      usn · redis · debian · 13

    • 5:8.0.2-3+deb13u2 · arm64 · trixie

      Fixed · Fixed: 5:8.0.2-3+deb13u1

      usn · redis · debian · 13

    • 5:8.0.2-3+deb13u2 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 5:8.0.2-3+deb13u1

      usn · redis · debian · 13

    • 5:8.0.2-3+deb13u2 · arm64 · trixie-security

      Fixed · Fixed: 5:8.0.2-3+deb13u1

      usn · redis · debian · 13

    • 5:8.0.2-3+deb13u3 · amd64 · trixie-security

      Fixed · Fixed: 5:8.0.2-3+deb13u1

      usn · redis · debian · 13

  • Source package: [valkey]

    Details (5)
    • 8.1.1+dfsg1-3+deb13u2 · amd64 · trixie

      Fixed · Fixed: 8.1.1+dfsg1-3+deb13u1

      usn · valkey · debian · 13

    • 8.1.1+dfsg1-3+deb13u2 · arm64 · trixie

      Fixed · Fixed: 8.1.1+dfsg1-3+deb13u1

      usn · valkey · debian · 13

    • 8.1.1+dfsg1-3+deb13u2 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 8.1.1+dfsg1-3+deb13u1

      usn · valkey · debian · 13

    • 8.1.1+dfsg1-3+deb13u2 · arm64 · trixie-security

      Fixed · Fixed: 8.1.1+dfsg1-3+deb13u1

      usn · valkey · debian · 13

    • 8.1.1+dfsg1-3+deb13u3 · amd64 · trixie-security

      Fixed · Fixed: 8.1.1+dfsg1-3+deb13u1

      usn · valkey · debian · 13

  • Source package: [valkey]

    Details (5)
    • 8.1.1+dfsg1-3+deb13u2 · amd64 · trixie

      Fixed · Fixed: 8.1.1+dfsg1-3+deb13u1

      usn · valkey · debian · 13

    • 8.1.1+dfsg1-3+deb13u2 · arm64 · trixie

      Fixed · Fixed: 8.1.1+dfsg1-3+deb13u1

      usn · valkey · debian · 13

    • 8.1.1+dfsg1-3+deb13u2 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 8.1.1+dfsg1-3+deb13u1

      usn · valkey · debian · 13

    • 8.1.1+dfsg1-3+deb13u2 · arm64 · trixie-security

      Fixed · Fixed: 8.1.1+dfsg1-3+deb13u1

      usn · valkey · debian · 13

    • 8.1.1+dfsg1-3+deb13u3 · amd64 · trixie-security

      Fixed · Fixed: 8.1.1+dfsg1-3+deb13u1

      usn · valkey · debian · 13

  • Source package: [valkey]

    Details (5)
    • 8.1.1+dfsg1-3+deb13u2 · amd64 · trixie

      Fixed · Fixed: 8.1.1+dfsg1-3+deb13u1

      usn · valkey · debian · 13

    • 8.1.1+dfsg1-3+deb13u2 · arm64 · trixie

      Fixed · Fixed: 8.1.1+dfsg1-3+deb13u1

      usn · valkey · debian · 13

    • 8.1.1+dfsg1-3+deb13u2 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 8.1.1+dfsg1-3+deb13u1

      usn · valkey · debian · 13

    • 8.1.1+dfsg1-3+deb13u2 · arm64 · trixie-security

      Fixed · Fixed: 8.1.1+dfsg1-3+deb13u1

      usn · valkey · debian · 13

    • 8.1.1+dfsg1-3+deb13u3 · amd64 · trixie-security

      Fixed · Fixed: 8.1.1+dfsg1-3+deb13u1

      usn · valkey · debian · 13

Observed:

References

[CERT-Bund public advisories] · [CISA cybersecurity advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]