CVE intelligence

CVE-2025-46686

Vulnerability intelligence

Published Jul 23, 2025Sources checked Sep 27, 2026

3.5LOWCVSS out of 10

What this means

Review the available evidence

CVE-2025-46686 and is rated Low severity with a CVSS score of 3.5. It is not in the current CISA KEV record we collected. That does not prove exploitation has not occurred.

CISA KEVNot listedBased on the latest collected catalog

EPSS0.3%Estimated 30-day exploitation probability

Ransomware useNot markedCISA KEV ransomware field

Threat actors0Source-linked actor relationships

Overview

What is CVE-2025-46686?

Redis through 8.0.3 allows memory consumption via a multi-bulk command composed of many bulks, sent by an authenticated user. This occurs because the server allocates memory for the command arguments of every bulk, even when the command is skipped because of insufficient permissions. NOTE: this is disputed by the Supplier because abuse of the commands network protocol is not a violation of the Redis Security Model.