Memory Consumption Vulnerability in Redis by Redis Labs

CVE-2025-46686

What is CVE-2025-46686?

Redis, up to version 7.4.3, is vulnerable to a memory consumption issue that can be exploited by authenticated users. This flaw allows attackers to send multi-bulk commands with numerous bulk segments, leading to excessive memory allocation on the server. The server allocates memory for these command arguments even when the commands are not executed due to insufficient permissions. As a result, this vulnerability can result in resource exhaustion, potentially impacting the performance and stability of the Redis service.

References