PT-2025-30614 · Redis+2 · Redis+2

Io-No · Published 2025-07-23 · Updated 2025-09-25 · CVE-2025-46686

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Redis versions through 7.4.3

Description Redis allows excessive memory consumption via a multi-bulk command consisting of numerous bulks sent by an authenticated user. The server allocates memory for command arguments for each bulk, even if the command is skipped due to insufficient permissions.

Recommendations Update to a version beyond 7.4.3.

Exploit

Fix

Memory Leak

Weakness Enumeration

CWE-789

CWE-401

Related Identifiers

BDU:2025-09083

BIT-KEYDB-2025-46686

BIT-REDIS-2025-46686

BIT-VALKEY-2025-46686

CVE-2025-46686

GHSA-2R7G-8HPC-RPQ9

Affected Products

Debian

Red Os

Redis

References · 20

• 🔥 https://github.com/io-no/CVE-Reports/issues/1 · Exploit
• https://osv.dev/vulnerability/BIT-redis-2025-46686 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-46686 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-09083 · Security Note
• https://osv.dev/vulnerability/CVE-2025-46686 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-46686 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-46686 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-46686 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-46686 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-keydb-2025-46686 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-46686 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-valkey-2025-46686 · Vendor Advisory
• https://github.com/redis/redis · Note
• https://github.com/redis/redis/security/advisories/GHSA-2r7g-8hpc-rpq9 · Note