CVE-2025-46686: redis
Vulnerability summary
CVE-2025-46686 is a low (CVSS 3.5) vulnerability in redis. EPSS estimates a 0.30% chance of exploitation in the next 30 days, higher than 21% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 23-07-2025PublishedVulnerability first disclosed.
- 26-08-2025Last modifiedVulnerability information updated.
Description
Redis through 8.0.3 allows memory consumption via a multi-bulk command composed of many bulks, sent by an authenticated user. This occurs because the server allocates memory for the command arguments of every bulk, even when the command is skipped because of insufficient permissions. NOTE: this is disputed by the Supplier because abuse of the commands network protocol is not a violation of the Redis Security Model.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated4.9MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:HDiffers
- OSV · DebianEcosystem advisory · calculated3.5LowCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
- OSV · ChainguardEcosystem advisory · calculated3.5LowCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
- NVDNIST3.5LowCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
EPSS trend
Probability
0.30%
Chance of exploitation in the next 30 days
Percentile
21%
Versus all other CVEs
30-day change
+0.03 pp
From 0.27% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard9 products
- py3-redisAll versions (No fix recorded)
- py3.10-redisAll versions (No fix recorded)
- py3.11-redisAll versions (No fix recorded)
- py3.12-redisAll versions (No fix recorded)
- py3.13-redisAll versions (No fix recorded)
Debian1 product
- redisAll versions (No fix recorded)
Redis1 product
- redis≤ 8.0.3
Ubuntu1 product
- redisAll versions (No fix recorded)
4 vendors · 12 products
