dwisiswant0/cve-2025-46817Proof-of-concept for Redis Lua unpack integer overflow (CVE-2025-46817) demonstrating stack blow-up and potential RCE on Redis 8.2.1.
unpack Integer Overflow (Potential RCE)Redis Lua unpack integer overflow PoC causing stack blow-up and crash on 8.2.1.
Redis 8.2.1 ships Lua 5.1 with an unpack implementation that computes the result count using signed integers. Carefully chosen start/end indices wrap the arithmetic, bypass lua_checkstack, and force Lua to push billions of results. Combined with table index wrapping, this can corrupt heap memory and lead to RCE.
redis-cliCVE-2025-46817.lua – calls unpack with a range that overflows signed arithmetic.redis-cli -h localhost -p 6379 --eval CVE-2025-46817.lua
Expected result:
On 8.2.1 the server typically terminates the connection or crashes from excessive stack growth. Redis 8.2.2 (commit fc9abc775e308374f667fdf3e723ef4b7eb0e3ca) rejects the call with "ERR Error running script (too many results to unpack)".
Upgrade to Redis 8.2.2 or later, which hardens luaB_unpack and luaH_getnum, or disable Lua scripting for untrusted users.