huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2025-40304: kernel: Linux kernel: Out-of-bounds write in fbdev can lead to privilege escalation, information disclosure, or denial of service.
Component: kernel
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H)
Public date: 2025-12-08T00:00:00+00:00

A flaw was found in the Linux kernel, specifically within the framebuffer device (fbdev) subsystem. This vulnerability, an out-of-bounds write, occurs because the `bit_putcs` function does not properly check boundaries when displaying text near the edges of the screen. A local user with low privileges could exploit this to write data beyond the intended memory area. This could potentially lead to serious consequences such as gaining unauthorized access (privilege escalation), revealing sensitive information (information disclosure), or causing the system to become unavailable (denial of service).


Affected upstream versions: 2.6.12
Fixed upstream versions: 0, 5.10.247, 5.15.197, 5.4.302, 6.1.159, 6.12.58, 6.17.8, 6.18, 6.6.117
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 996bfaa7372d6718b6d860bdf78f6618e850c702
CVE-2025-40318: kernel: Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once
Component: kernel
Severity: Moderate
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-12-08T00:00:00+00:00

A use-after-free flaw was found in hci_cmd_sync_dequeue_once in net/bluetooth/hci_sync.c in Bluetooth: hci_sync in Linux Kernel. This vulnerability could even lead to a kernel information leak problem.


Affected upstream versions: 6.1.120 < 6.1.159, 6.6.51 < 6.6.117, 6.8.9 < 6.9, 6.9
Fixed upstream versions: 0, 6.1.159, 6.12.58, 6.17.8, 6.18, 6.6.117, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 0a94f7e017438935c09ef833a1aa908ad9875213
CVE-2025-40320: kernel: smb: client: fix potential cfid UAF in smb2_query_info_compound
Component: kernel
Severity: Moderate
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 6.3 (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:H)
Public date: 2025-12-08T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix potential cfid UAF in smb2_query_info_compound

When smb2_query_info_compound() retries, a previously allocated cfid may
have been freed in the first attempt.
Because cfid wasn't reset on replay, later cleanup could act on a stale
pointer, leading to a potential use-after-free.

Reinitialize cfid to NULL under the replay label.

Example trace (trimmed):

refcount_t: underflow; use-after-free.
WARNING: CPU: 1 PID: 11224 at ../lib/refcount.c:28 refcount_warn_saturate+0x9c/0x110
[...]
RIP: 0010:refcount_warn_saturate+0x9c/0x110
[...]
Call Trace:
 <TASK>
 smb2_query_info_compound+0x29c/0x5c0 [cifs f90b72658819bd21c94769b6a652029a07a7172f]
 ? step_into+0x10d/0x690
 ? __legitimize_path+0x28/0x60
 smb2_queryfs+0x6a/0xf0 [cifs f90b72658819bd21c94769b6a652029a07a7172f]
 smb311_queryfs+0x12d/0x140 [cifs f90b72658819bd21c94769b6a652029a07a7172f]
 ? kmem_cache_alloc+0x18a/0x340
 ? getname_flags+0x46/0x1e0
 cifs_statfs+0x9f/0x2b0 [cifs f90b72658819bd21c94769b6a652029a07a7172f]
 statfs_by_dentry+0x67/0x90
 vfs_statfs+0x16/0xd0
 user_statfs+0x54/0xa0
 __do_sys_statfs+0x20/0x50
 do_syscall_64+0x58/0x80


Affected upstream versions: 6.6.32 < 6.6.117, 6.8
Fixed upstream versions: 0, 6.12.58, 6.17.8, 6.18, 6.6.117
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 939c4e33005e2a56ea8fcedddf0da92df864bd3b
CVE-2025-40322: kernel: Linux kernel: Information disclosure and denial of service via out-of-bounds read in font glyph handling
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2025-12-08T00:00:00+00:00

A flaw was found in the Linux kernel. A local attacker can exploit this vulnerability by providing a specially crafted font glyph index to the bitblit component. This can lead to an out-of-bounds read, potentially resulting in information disclosure or a denial of service.


Affected upstream versions: 2.6.12
Fixed upstream versions: 0, 5.10.247, 5.15.197, 5.4.302, 6.1.159, 6.12.58, 6.17.8, 6.18, 6.6.117
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: a10cede006f9614b465cf25609a8753efbfd45cc
CVE-2025-4057: activemq-artemis-operator: AMQ Broker Operator Starting Credentials Reuse
Component: activemq-artemis-operator
Severity: Moderate
CWE: CWE-1391 (Use of Weak Credentials)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Public date: 2025-05-21T00:00:00+00:00

A flaw was found in ActiveMQ Artemis. The password generated by activemq-artemis-operator does not regenerate between separated CR dependencies.


Affected upstream versions: <= v2.0.2
Fixed upstream versions: 2.0.3, 7.12.5-2
Upstream repository: https://github.com/arkmq-org/activemq-artemis-operator
Upstream fix commit: d3482fab6d0060794226c9e5a6fa67d209abc35a
CVE-2025-40909: perl: Perl threads have a working directory race condition where file operations may target unintended paths
Component: perl
Severity: Moderate
CWE: CWE-427 (Uncontrolled Search Path Element)
CVSS v3: 5.9 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2025-05-30T12:20:11.237000+00:00

A flaw was found in the Perl standard library threads component. This vulnerability can allow a local attacker to exploit a race condition in directory handling to access files or load code from unexpected locations.


Affected upstream versions: 5.13.6 < 5.41.13
Fixed upstream versions: 5.41.13
Upstream repository: https://github.com/Perl/perl5
Upstream fix commit: 11a11ecf4bea72b17d250cfb43c897be1341861e
CVE-2025-4138: cpython: python: Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory
Component: cpython
Severity: Important
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2025-06-03T12:59:02.717000+00:00

A flaw was found in the Python tarfile module. This vulnerability allows attackers to bypass extraction filters, enabling symlink targets to escape the destination directory and allowing unauthorized modification of file metadata via the use of TarFile.extract() or TarFile.extractall() with the filter= parameter set to "data" or "tar".

Statement: Versions of python36:3.6/python36 as shipped with Red Hat Enterprise Linux 8 are marked as 'Not affected' as they just provide "symlinks" to the main python3 component, which provides the actual interpreter of the Python programming language.

Affected upstream versions: 3.11.0 < 3.11.13, 3.12.0 < 3.12.11, 3.13.0 < 3.13.4, 3.14.0a1 < 3.14.0b3
Fixed upstream versions: v3.15.0a1
Upstream repository: https://github.com/python/cpython
Upstream fix commit: 3612d8f51741b11f36f8fb0494d79086bac9390a
CVE-2025-43272: webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash
Component: webkitgtk
Severity: Important
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2025-09-23T00:00:00+00:00

A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.

Statement: To exploit this flaw, an attacker needs to trick a user into processing or loading malicious web content.

Affected upstream versions: <= WebKit-7622.1.10
Fixed upstream versions: 26
Upstream repository: https://github.com/WebKit/WebKit
Upstream fix commit: fa85413077accf8c881ff88684eb5dcc6ddebea2
CVE-2025-4330: cpython: python: Extraction filter bypass for linking outside extraction directory
Component: cpython
Severity: Moderate
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 7.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N)
Public date: 2025-06-03T12:58:57.452000+00:00

A flaw was found in CPython's tarfile module. This vulnerability allows bypassing of extraction filters, enabling symlink traversal outside the intended extraction directory and potential modification of file metadata via malicious tar archives using TarFile.extractall() or TarFile.extract() with the filter="data" or filter="tar" parameters. This issue leads to potentially overwriting or modifying system files and metadata.

Statement: The severity of this vulnerability was lowered due to the fact that successful exploitation requires the attacker to convince a privileged user or process to extract a malicious tar file. Since tar file extraction typically occurs in trusted contexts or with elevated privileges, the impact is reduced by the requirement of this access.

Versions of python36:3.6/python36 as shipped with Red Hat Enterprise Linux 8 are marked as 'Not affected' as they just provide "symlinks" to the main python3 component, which provides the actual interpreter of the Python programming language.

Affected upstream versions: 3.11.0 < 3.11.13, 3.12.0 < 3.12.11, 3.13.0 < 3.13.4, 3.14.0a1 < 3.14.0b3
Fixed upstream versions: v3.15.0a1
Upstream repository: https://github.com/python/cpython
Upstream fix commit: 3612d8f51741b11f36f8fb0494d79086bac9390a
CVE-2025-43342: webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash
Component: webkitgtk
Severity: Important
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2025-09-23T00:00:00+00:00

A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper checks.

Statement: To exploit this flaw, an attacker needs to trick a user into processing or loading malicious web content.

Affected upstream versions: <= WebKit-7622.1.10
Fixed upstream versions: 18.7, 26
Upstream repository: https://github.com/WebKit/WebKit
Upstream fix commit: f3f7e7880c36ac7d0735efc084c618382194382e
CVE-2025-43343: webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash
Component: webkitgtk
Severity: Important
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2025-10-13T00:00:00+00:00

A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.

Statement: To exploit this flaw, an attacker needs to trick a user into processing or loading malicious web content.

Affected upstream versions: <= WebKit-7623.1.8
Fixed upstream versions: 26
Upstream repository: https://github.com/WebKit/WebKit
Upstream fix commit: 899a38cf9a50a555c1fb3fd5e3ae21271447ecc8
CVE-2025-43356: webkitgtk: A website may be able to access sensor information without user consent
Component: webkitgtk
Severity: Moderate
CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Public date: 2025-09-23T00:00:00+00:00

A flaw was found in WebKitGTK. A malicious website can obtain access to sensor information without user consent due to improper handling of caches.

Statement: To exploit this flaw, an attacker needs to trick a user into visiting a malicious website.

Affected upstream versions: <= WebKit-7622.1.10
Fixed upstream versions: 18.7, 26
Upstream repository: https://github.com/WebKit/WebKit
Upstream fix commit: fbe01734a08b94759e2a1759bcf0ea1f279c95a4
CVE-2025-43368: webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash
Component: webkitgtk
Severity: Important
CWE: CWE-416 (Use After Free)
CVSS v3: 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2025-09-23T00:00:00+00:00

A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory management and result in an unexpected process crash.

Statement: To exploit this flaw, an attacker needs to trick a user into processing or loading malicious web content.

Affected upstream versions: <= WebKit-7622.1.10
Fixed upstream versions: 26
Upstream repository: https://github.com/WebKit/WebKit
Upstream fix commit: 674611789255a98f96b4504c7d04034e0ae5908a
CVE-2025-43718: poppler: Poppler stack overflow
Component: poppler
Severity: Moderate
CWE: CWE-674 (Uncontrolled Recursion)
CVSS v3: 4 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-10-01T00:00:00+00:00

A stack overflow flaw has been discovered in Poppler. This stack overflow which leads to a SIGSEGV crash occurs via deeply nested structures within the metadata of a PDF document. This occurs in Dict::lookup, Catalog::getMetadata, and associated functions in PDFDoc, with deep recursion in the regex executor (std::__detail::_Executor).

Statement: On Red Hat systems a process which issues a SIGSEGV signal is terminated. The only risk to Red Hat users is that the process using poppler may halt.

Affected upstream versions: 24.06.1 < 25.04.0
Fixed upstream versions: 25.04.0
Upstream repository: https://gitlab.freedesktop.org/poppler/poppler
Upstream fix commit: f54b815672117c250420787c8c006de98e8c7408
CVE-2025-43859: h11: h11 accepts some malformed Chunked-Encoding bodies
Component: h11
Severity: Important
CWE: CWE-444 (Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'))
CVSS v3: 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
Public date: 2025-04-24T18:15:53.328000+00:00

A flaw was found in the h11. This vulnerability allows request smuggling via improper parsing of chunked-coding message bodies, where h11 fails to validate the required \r\n terminators.


Affected upstream versions: < 0.16.0
Fixed upstream versions: v0.16.0
Upstream repository: https://github.com/python-hyper/h11
Upstream fix commit: 114803a29ce50116dc47951c690ad4892b1a36ed
CVE-2025-43865: react-router: React Router allows pre-render data spoofing on React-Router framework mode
Component: react-router
Severity: Moderate
CWE: CWE-345 (Insufficient Verification of Data Authenticity)
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L)
Public date: 2025-04-25T00:18:53.222000+00:00

A flaw was found in React Router. This vulnerability allows an attacker to spoof pre-rendered data and potentially poison the cache via the X-React-Router-Prerender-Data header, enabling arbitrary content injection on the target page.

Statement: The severity of this vulnerability is rated Moderate, as it does not impact system availability. The effects are confined to the application layer, specifically involving data manipulation and potential cache poisoning, without compromising the underlying system stability.

Affected upstream versions: >= 7.0, < 7.5.2
Fixed upstream versions: v0.0.0-experimental-aecfb0db1
Upstream repository: https://github.com/remix-run/react-router
Upstream fix commit: c84302972a152d851cf5dd859ff332b354b70111
CVE-2025-4435: cpython: Tarfile extracts filtered members when errorlevel=0
Component: cpython
Severity: Moderate
CWE: CWE-706 (Use of Incorrectly-Resolved Name or Reference)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Public date: 2025-06-03T12:59:06.792000+00:00

A flaw was found in CPython's tarfile module. This vulnerability allows unauthorized file extraction via crafted tar archives when TarFile.errorlevel=0, bypassing expected filtering mechanisms.

Statement: The severity of this vulnerability was lowered due to the fact that successful exploitation requires the attacker to convince a privileged user or process to extract a malicious tar file. Since tar file extraction typically occurs in trusted contexts or with elevated privileges, the impact is reduced by the requirement of such access.

Versions of python36:3.6/python36 as shipped with Red Hat Enterprise Linux 8 are marked as 'Not affected' as they just provide "symlinks" to the main python3 component, which provides the actual interpreter of the Python programming language.

Affected upstream versions: 3.11.0 < 3.11.13, 3.12.0 < 3.12.11, 3.13.0 < 3.13.4, 3.14.0a1 < 3.14.0b3
Fixed upstream versions: v3.15.0a1
Upstream repository: https://github.com/python/cpython
Upstream fix commit: 3612d8f51741b11f36f8fb0494d79086bac9390a
CVE-2025-4516: cpython: python: CPython DecodeError Handling Vulnerability
Component: cpython
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 5.1 (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-05-15T13:29:20.126000+00:00

A vulnerability has been identified in CPython's bytes.decode() function when used with the "unicode_escape" encoding and the "ignore" or "replace" error handling modes. This flaw can result in the incorrect decoding of byte strings. While this may not directly lead to traditional security breaches like data exfiltration, the resulting unexpected program behavior could introduce instability, logic errors, or unintended side effects within applications that rely on this specific decoding functionality.


Affected upstream versions: 3.11.0 < 3.11.13, 3.12.0 < 3.12.11, 3.13.0 < 3.13.4, 3.14.0a1 < 3.14.0b2
Fixed upstream versions: v3.14.0
Upstream repository: https://github.com/python/cpython
Upstream fix commit: 69b4387f78f413e8c47572a85b3478c47eba8142
CVE-2025-4517: python: cpython: Arbitrary writes via tarfile realpath overflow
Component: python
Severity: Important
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 7.6 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L)
Public date: 2025-06-03T12:58:50.352000+00:00

A flaw was found in the CPython tarfile module. This vulnerability allows arbitrary filesystem writes outside the extraction directory via extracting untrusted tar archives using the TarFile.extractall() or TarFile.extract() methods with the extraction filter parameter set to "data" or "tar".

Statement: The severity of this vulnerability was lowered due to the fact that successful exploitation requires the attacker to convince a privileged user or process to extract a malicious tar file. Since tar file extraction typically occurs in trusted contexts or with elevated privileges, the impact is reduced by the requirement of such access.

Versions of python36:3.6/python36 as shipped with Red Hat Enterprise Linux 8 are marked as 'Not affected' as they just provide "symlinks" to the main python3 component, which provides the actual interpreter of the Python programming language.

Affected upstream versions: 3.11.0 < 3.11.13, 3.12.0 < 3.12.11, 3.13.0 < 3.13.4, 3.14.0a1 < 3.14.0b3
Fixed upstream versions: v3.15.0a1
Upstream repository: https://github.com/python/cpython
Upstream fix commit: 3612d8f51741b11f36f8fb0494d79086bac9390a
CVE-2025-4565: python-protobuf: Unbounded recursion in Python Protobuf
Component: python-protobuf
Severity: Moderate
CWE: CWE-674 (Uncontrolled Recursion)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-06-16T14:50:40.906000+00:00

A flaw was found in the python protobuf package which can result in a denial of service. Applications that parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages, or a series of SGROUP tags can be corrupted by exceeding the Python recursion limit. This can result in a Denial of service by crashing the application that integrates the package with a RecursionError.

Statement: The availability impact of this denial-of-service vulnerability is confined to applications that directly integrate the Protobuf package. Within the context of a Red Hat system, the host machine itself is not expected to be impacted, thereby limiting the scope of disruption to individual application instances rather than broader system instability.

Affected upstream versions: <= v25.0
Fixed upstream versions: 4.25.8, 5.29.5, 6.31.1
Upstream repository: https://github.com/protocolbuffers/protobuf
Upstream fix commit: 17838beda2943d08b8a9d4df5b68f5f04f26d901
CVE-2025-46727: rubygem-rack: Unbounded-Parameter DoS in Rack::QueryParser
Component: rubygem-rack
Severity: Important
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-05-07T23:07:40.563000+00:00

A flaw was found in Rack::QueryParser. This vulnerability allows denial of service via oversized HTTP requests containing many parameters, resulting in memory exhaustion that consumes all available memory or CPU resource pinning, which keeps the CPU constantly busy.

Statement: This vulnerability is rated as an IMPORTANT severity because the vulnerabilty was found in the Rack::QueryParser component which arises because Rack::QueryParser parses query strings and application/x-www-form-urlencoded bodies into Ruby data structures without imposing any limit on the number of parameters, when an attacker sends requests with an extremely large number of parameters, Rack::QueryParser consumes excessive memory and CPU during parsing, leading to memory exhaustion, this results in a denial of service, causing the Rack server to crash and leading to full service disruption.

Red Hat Satellite 6.15 includes an affected version of rubygem-rack; however, since it does not utilize Rack::QueryParser, it is not actually vulnerable to the flaw, lowering product-specific impact. The issue has already been addressed in Red Hat Satellite versions 6.16 and 6.17, and updates for other supported versions may follow based on the product lifecycle policy.

Affected upstream versions: < 2.2.14, >= 3.0, < 3.0.16, >= 3.1, < 3.1.14
Fixed upstream versions: v3.0.16
Upstream repository: https://github.com/rack/rack
Upstream fix commit: 2bb5263b464b65ba4b648996a579dbd180d2b712
CVE-2025-46817: redis: Lua library commands may lead to integer overflow and potential RCE
Component: redis
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-10-03T17:52:48.478000+00:00

An integer overflow present in the Redis Lua scripting engine that allows an authenticated client to submit a specially crafted Lua script (for example via EVAL/EVALSHA) that can trigger memory corruption and potentially lead to remote code execution within the Redis server process.

Statement: This is classified as Moderate because exploitation requires an authenticated client with permission to execute Lua scripts (for example via EVAL/EVALSHA) rather than an unauthenticated network attacker, narrowing the exposure to already trusted principals or compromised application identities. The flaw is an integer overflow in Lua script handling that can corrupt memory, but reliable code execution is non-trivial and there are no public proofs of concept or known in-the-wild exploits as of the initial advisories, which lowers immediate operational risk despite the theoretical impact. Practically, triggering a controlled overflow through the embedded Lua runtime adds exploit complexity, as the attacker must shape arithmetic and memory behavior inside Redis’s scripting environment to gain control flow, increasing the likelihood of crashes over deterministic RCE in typical configurations. Even in a worst case, the effect is within the Redis server process context rather than a guaranteed system-wide compromise, further reducing systemic blast radius if the service is not over-privileged.

This flaw exists only in the Redis server implementation; 

Redis client libraries (Python, Node.js, Rust, etc.) are not affected by this vulnerability, and it only exists in the Redis server’s embedded Lua engine where scripts execute. Client libraries merely transmit EVAL/EVALSHA to the server.

Affected upstream versions: < 8.2.2
Fixed upstream versions: 8.2.2
Upstream repository: https://github.com/redis/redis
Upstream fix commit: fc9abc775e308374f667fdf3e723ef4b7eb0e3ca