CVE-2025-46686: Low severity Redis redis vulnerability
Redis through 8.0.3 allows memory consumption via a multi-bulk command composed of many bulks, sent by an authenticated user. This occurs because the server allocates memory for the command arguments of every bulk, even when the command is skipped because of insufficient permissions. NOTE: this is disputed by the Supplier because abuse of the commands network protocol is not a violation of the Redis Security Model.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-46686?
The severity of CVE-2025-46686 is classified as a medium risk due to its potential for memory consumption issues.
How do I fix CVE-2025-46686?
To fix CVE-2025-46686, upgrade Redis to version 7.4.4 or later, or version 8.0.4 or later.
Who is affected by CVE-2025-46686?
CVE-2025-46686 affects users of Redis versions up to 7.4.3 and 8.0.3.
What can attackers do with CVE-2025-46686?
Attackers can exploit CVE-2025-46686 to consume server memory by sending specially crafted multi-bulk commands.
What is the underlying issue of CVE-2025-46686?
The underlying issue in CVE-2025-46686 is that Redis allocates memory for all command arguments regardless of permission checks.