dwisiswant0/cve-2025-46819Proof-of-concept exploit for CVE-2025-46819, a Redis Lua long-string delimiter out-of-bounds read, demonstrating a crash via malformed input.
Malformed long-string delimiter causing Lua lexer OOBs read on Redis 8.2.1.
Lua's long-string parser in Redis 8.2.1 mishandles malformed [=... sequences, returning sentinel values that lead to buffer underflows or excessive recursion. Attackers can cause Redis to read out of bounds or overflow the C stack.
redis-cliCVE-2025-46819.lua – constructs a huge malformed delimiter and feeds it to loadstring.redis-cli -h localhost -p 6379 --eval CVE-2025-46819.lua
Expected result:
On vulnerable versions you'll typically see "ERR C stack overflow" or an immediate crash. Redis 8.2.2 (commit 3a1624da2449ac3dbfc4bdaed43adf77a0b7bfba) rejects the script with "invalid long string delimiter" without destabilizing the server.
Upgrade to Redis 8.2.2 or later, or disable Lua for untrusted users.