CVE-2025-46686
Fixed in a distro release EPSS <1%CVSS 3.5
Redis through 8.0.3 allows memory consumption via a multi-bulk command composed of many bulks, sent by an authenticated user. This occurs because the server allocates memory for the command arguments of every bulk, even when the command is skipped because of insufficient permissions. NOTE: this is disputed by the Supplier because abuse of the commands network protocol is not a violation of the Redis Security Model.
Products: Redis
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | py3-redis | 0 |
| Chainguard | py3.10-redis | 0 |
| Chainguard | py3.11-redis | 0 |
| Chainguard | py3.12-redis | 0 |
| Chainguard | py3.13-redis | 0 |
| Chainguard | redis-6.2 | 0 |
| Chainguard | redis-6.2.10 | 0 |
| Chainguard | redis-7.2 | 0 |
| Chainguard | redis-7.4 | 0 |
| Chainguard | redis-8.0 | 0 |
| Debian 12 | redis | no fix |
| Debian 13 | redis | no fix |
| Debian 14 | redis | no fix |
| Ubuntu 24.04 LTS | redis | no fix |
| Ubuntu 25.10 | redis | no fix |
| Ubuntu 26.04 LTS | redis | no fix |
| Ubuntu Pro 14.04 LTS | redis | no fix |
| Ubuntu Pro 16.04 LTS | redis | no fix |
| Ubuntu Pro 18.04 LTS | redis | no fix |
| Ubuntu Pro 20.04 LTS | redis | no fix |
| Ubuntu Pro 22.04 LTS | redis | no fix |
| Wolfi | redis-6.2 | 0 |
| Wolfi | redis-7.2 | 0 |
| Wolfi | redis-7.4 | 0 |