CVE-2025-46686
Redis through 7.4.3 allows memory consumption via a multi-bulk command composed of many bulks,...
Redis through 8.0.3 allows memory consumption via a multi-bulk command composed of many bulks, sent by an authenticated user. This occurs because the server allocates memory for the command arguments of every bulk, even when the command is skipped because of insufficient permissions. NOTE: this is disputed by the Supplier because abuse of the commands network protocol is not a violation of the Redis Security Model.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Redis through 8.0.3 allows memory consumption via a multi-bulk command composed of many bulks, sent by an authenticated user. This occurs because the server allocates memory for the command arguments of every bulk, even when the command is skipped because of insufficient permissions. NOTE: this is disputed by the Supplier because abuse of the commands network protocol is not a violation of the Redis Security Model.
- Record
CVE-2025-46686- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-401
- Updated
- 2026-11-02
EUVDEUVD-2025-22464
Redis through 8.0.3 allows memory consumption via a multi-bulk command composed of many bulks, sent by an authenticated user. This occurs because the server allocates memory for the command arguments of every bulk, even when the command is skipped because of insufficient permissions. NOTE: this is disputed by the Supplier because abuse of the commands network protocol is not a violation of the Redis Security Model.
- Record
EUVD-2025-22464- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-f46f-fjf4-h4m2
Redis through 7.4.3 allows memory consumption via a multi-bulk command composed of many bulks,...
Redis through 7.4.3 allows memory consumption via a multi-bulk command composed of many bulks, sent by an authenticated user. This occurs because the server allocates memory for the command arguments of every bulk, even when the command is skipped because of insufficient permissions.
- Record
GHSA-f46f-fjf4-h4m2- CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-401, CWE-789
- Updated
- 2026-11-02
NVD
Redis through 8.0.3 allows memory consumption via a multi-bulk command composed of many bulks, sent by an authenticated user. This occurs because the server allocates memory for the command arguments of every bulk, even when the command is skipped because of insufficient permissions. NOTE: this is disputed by the Supplier because abuse of the commands network protocol is not a violation of the Redis Security Model.
- Record
CVE-2025-46686- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-401
- Updated
- 2026-11-02
OSV
Redis through 8.0.3 allows memory consumption via a multi-bulk command composed of many bulks, sent by an authenticated user. This occurs because the server allocates memory for the command arguments of every bulk, even when the command is skipped because of insufficient permissions. NOTE: this is disputed by the Supplier because abuse of the commands network protocol is not a violation of the Redis Security Model.
- Record
CVE-2025-46686- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-401
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-46686
Redis through 8.0.3 allows memory consumption via a multi-bulk command composed of many bulks, sent by an authenticated user. This occurs because the server allocates memory for the command arguments of every bulk, even when the command is skipped because of insufficient permissions. NOTE: this is disputed by the Supplier because abuse of the commands network protocol is not a violation of the Redis Security Model.
- Record
DEBIAN-CVE-2025-46686- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2025-46686
Redis through 8.0.3 allows memory consumption via a multi-bulk command composed of many bulks, sent by an authenticated user. This occurs because the server allocates memory for the command arguments of every bulk, even when the command is skipped because of insufficient permissions. NOTE: this is disputed by the Supplier because abuse of the commands network protocol is not a violation of the Redis Security Model.
- Record
UBUNTU-CVE-2025-46686- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVBIT-keydb-2025-46686 No score
Redis through 8.0.3 allows memory consumption via a multi-bulk command composed of many bulks, sent by an authenticated user. This occurs because the server allocates memory for the command arguments of every bulk, even when the command is skipped because of insufficient permissions. NOTE: this is disputed by the Supplier because abuse of the commands network protocol is not a violation of the Redis Security Model.
- Record
BIT-keydb-2025-46686- Updated
- 2026-11-02
OSVBIT-redis-2025-46686 No score
Redis through 8.0.3 allows memory consumption via a multi-bulk command composed of many bulks, sent by an authenticated user. This occurs because the server allocates memory for the command arguments of every bulk, even when the command is skipped because of insufficient permissions. NOTE: this is disputed by the Supplier because abuse of the commands network protocol is not a violation of the Redis Security Model.
- Record
BIT-redis-2025-46686- Updated
- 2026-11-02
OSVBIT-valkey-2025-46686 No score
Redis through 8.0.3 allows memory consumption via a multi-bulk command composed of many bulks, sent by an authenticated user. This occurs because the server allocates memory for the command arguments of every bulk, even when the command is skipped because of insufficient permissions. NOTE: this is disputed by the Supplier because abuse of the commands network protocol is not a violation of the Redis Security Model.
- Record
BIT-valkey-2025-46686- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
keydbBitnami |
through 8.0.3 | None known |
redisBitnami |
before 8.0.4 | 8.0.4 |
valkeyBitnami |
before 8.0.4 | 8.0.4 |
redisDebian:12 |
All versions, plus listed versions 5:7.0.11-15:7.0.11-1+deb12u15:7.0.12-15:7.0.12-25:7.0.13-1 Show 42 moreShow less5:7.0.13-25:7.0.14-15:7.0.14-25:7.0.15-15:7.0.15-1~deb12u15:7.0.15-1~deb12u25:7.0.15-1~deb12u35:7.0.15-1~deb12u45:7.0.15-1~deb12u55:7.0.15-1~deb12u65:7.0.15-1~deb12u75:7.0.15-1~deb12u85:7.0.15-1~deb12u95:7.0.15-25:7.0.15-35:7.0.15-3.15:7.2-rc2-15:7.2-rc3-15:7.2.0-15:7.2.0-25:7.2.1-15:7.2.1-25:7.2.2-15:7.2.2-25:7.2.3-15:7.2.4-15:7.2.5-15:7.2.5-25:7.2.5-35:7.2~rc1-15:8.0.0-15:8.0.0-25:8.0.2-25:8.0.2-35:8.0.4-15:8.0.5-15:8.0.6-15:8.0.6-25:8.4.0-15:8.6.1-15:8.6.2-15:8.6.3-1 |
None known |
redisDebian:13 |
All versions, plus listed versions 5:8.0.2-35:8.0.2-3+deb13u15:8.0.2-3+deb13u25:8.0.4-15:8.0.5-1 Show 6 moreShow less5:8.0.6-15:8.0.6-25:8.4.0-15:8.6.1-15:8.6.2-15:8.6.3-1 |
None known |
redisDebian:14 |
All versions, plus listed versions 5:8.0.2-35:8.0.4-15:8.0.5-15:8.0.6-15:8.0.6-2 Show 4 moreShow less5:8.4.0-15:8.6.1-15:8.6.2-15:8.6.3-1 |
None known |
redisUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 2:2.6.13-12:2.6.16-32:2.8.0-12:2.8.2-12:2.8.4-2 Show 6 moreShow less2:2.8.4-2ubuntu0.22:2.8.4-2ubuntu0.2+esm12:2.8.4-2ubuntu0.2+esm22:2.8.4-2ubuntu0.2+esm32:2.8.4-2ubuntu0.2+esm42:2.8.4-2ubuntu0.2+esm5 |
None known |
redisUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2:3.0.3-32:3.0.5-12:3.0.5-22:3.0.5-32:3.0.5-4 Show 9 moreShow less2:3.0.6-12:3.0.6-1ubuntu0.22:3.0.6-1ubuntu0.32:3.0.6-1ubuntu0.42:3.0.6-1ubuntu0.4+esm12:3.0.6-1ubuntu0.4+esm22:3.0.6-1ubuntu0.4+esm32:3.0.6-1ubuntu0.4+esm42:3.0.6-1ubuntu0.4+esm5 |
None known |
redisUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 4:4.0.1-74:4.0.2-64:4.0.2-95:4.0.5-15:4.0.6-1 Show 13 moreShow less5:4.0.6-25:4.0.7-15:4.0.8-15:4.0.8-25:4.0.9-15:4.0.9-1ubuntu0.15:4.0.9-1ubuntu0.25:4.0.9-1ubuntu0.2+esm25:4.0.9-1ubuntu0.2+esm35:4.0.9-1ubuntu0.2+esm45:4.0.9-1ubuntu0.2+esm55:4.0.9-1ubuntu0.2+esm65:4.0.9-1ubuntu0.2+esm7 |
None known |
redisUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 5:5.0.5-2build15:5.0.6-15:5.0.7-15:5.0.7-25:5.0.7-2ubuntu0.1~esm1 Show 5 moreShow less5:5.0.7-2ubuntu0.15:5.0.7-2ubuntu0.1+esm15:5.0.7-2ubuntu0.1+esm25:5.0.7-2ubuntu0.1+esm35:5.0.7-2ubuntu0.1+esm4 |
None known |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
redisUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 5:6.0.15-15:6.0.16-15:6.0.16-1build15:6.0.16-1ubuntu15:6.0.16-1ubuntu1+esm1 Show 5 moreShow less5:6.0.16-1ubuntu1+esm25:6.0.16-1ubuntu1.15:6.0.16-1ubuntu1.1+esm15:6.0.16-1ubuntu1.25:6.0.16-1ubuntu1.2+esm1 |
None known |
redisUbuntu:24.04:LTS |
All versions, plus listed versions 5:7.0.12-15:7.0.14-15:7.0.14-25:7.0.15-15:7.0.15-1build1 Show 6 moreShow less5:7.0.15-1build25:7.0.15-1ubuntu0.24.04.15:7.0.15-1ubuntu0.24.04.25:7.0.15-1ubuntu0.24.04.35:7.0.15-1ubuntu0.24.04.45:7.0.15-1ubuntu0.24.04.5 |
None known |
redisUbuntu:25.10 |
All versions, plus listed versions 5:7.0.15-35:7.0.15-3.15:8.0.2-35:8.0.2-3build15:8.0.2-3ubuntu0.25.10.1 |
None known |
redisUbuntu:26.04:LTS |
All versions, plus listed versions 5:8.0.2-3build15:8.0.2-3ubuntu0.25.10.15:8.0.5-15:8.0.5-1ubuntu0.1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-46686 is a low vulnerability (CVSS 3.5) in Redis, published July 23, 2025. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 0.32%, the 25th percentile. Fixed in redis 8.0.4.
References
github.com/redis/redis
nvd.nist.gov/vuln/detail/CVE-2025-46686
security-tracker.debian.org/tracker/CVE-2025-46686
ubuntu.com/security/CVE-2025-46686
cve.org/CVERecord?id=CVE-2025-46686