CVE-2025-46686CWE-401

Redis through 8.0.3 allows memory consumption via a multi-bulk command composed of many bulks, sent by an authenticated user

Low · published July 23, 2025

CVSS v3.1
3.5
EPSS
0%
Percentile
21.2
In the wild
Unconfirmed
What it is

Redis through 8.0.3 allows memory consumption via a multi-bulk command composed of many bulks, sent by an authenticated user. This occurs because the server allocates memory for the command arguments of every bulk, even when the command is skipped because of insufficient permissions. NOTE: this is disputed by the Supplier because abuse of the commands network protocol is not a violation of the Redis Security Model.

The record
Technical detail
CVSS v3.1
3.5 · LOW
Vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00297 · 21.2th percentile
Weakness
CWE-401 · Missing Release of Memory after Effective Lifetime
Published
2025-07-23T00:00Z
EPSS history
Timeline
  • 23 JUL 00:00Z
    Redis through 8.0.3 allows memory consumption via a multi-bulk command composed of many bulks, sent by an authenticated user
    cvelistv5