CVE-2025-46686: Memory Consumption in Redis 8.0.3

The primary impact of CVE-2025-46686 is denial-of-service (DoS). An attacker, authenticated to the Redis instance, can craft a malicious multi-bulk command. This command, composed of many bulk values, forces the Redis server to allocate memory for each bulk, even if the user lacks permissions to execute the command fully. Repeatedly sending such commands can exhaust server memory, leading to instability, performance degradation, and ultimately, a crash. The blast radius is limited to the affected Redis instance, but a successful DoS could disrupt applications relying on Redis for caching, session management, or other critical functions. While the vendor disputes the severity, the potential for resource exhaustion warrants careful attention.

1. Reserved2025-04-27
2. Published2025-07-23
3. Modified2025-08-26
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-46686 is upgrading to Redis version 8.0.4 or later, which contains the fix. If an immediate upgrade is not feasible, consider implementing rate limiting on multi-bulk commands to restrict the number of requests from a single authenticated user within a given timeframe. Network-level firewalls or proxy servers can also be configured to inspect and block suspicious multi-bulk command patterns. Monitor Redis memory usage closely for unusual spikes, which could indicate exploitation attempts. After upgrading, confirm the fix by sending a crafted multi-bulk command and verifying that memory allocation remains within acceptable limits.