Read the docs
TI-2025-29364 Aliases CVE-2025-46686GHSA-f46f-fjf4-h4m2

Memory leak in Redis

Priority MEDIUM 50CWE-401Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-401.

Summary

Redis through 8.0.3 allows memory consumption via a multi-bulk command composed of many bulks, sent by an authenticated user. This occurs because the server allocates memory for the command arguments of every bulk, even when the command is skipped because of insufficient permissions. NOTE: this is disputed by the Supplier because abuse of the commands network protocol is not a violation of the Redis Security Model.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00319 25th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
RedisRedisup to 8.0.3—No fix listedCNA
  • Redis VendorRedis Affected up to 8.0.3 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:*——Redis
  • cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:* Versions — — ·Redis

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-46686
  2. 2026-10-03 Alias added: GHSA-f46f-fjf4-h4m2

References

Other 3

  • TI-2022-00463 Missing authorization in Debian redis KEVCVSS 3.1CRITICAL 10.0
  • TI-2025-31759 Redis Lua Use-After-Free may lead to remote code execution CVSS 3.1CRITICAL 10.0
  • TI-2023-15161 Redis raft master-1b8bd86 to master-7b46079 was discovered to contain an ODR violation… CVSS 3.1CRITICAL 9.8
  • TI-2023-18618 Heap overflow in COMMAND GETKEYS and ACL evaluation in Redis CVSS 3.1HIGH 8.8
  • TI-2024-20813 Lua library commands may lead to stack overflow and RCE in Redis CVSS 3.1HIGH 8.8
  • TI-2022-08647 Heap overflow issue with the Lua cjson library used by Redis CVSS 3.1HIGH 8.8
See all 59 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences