CVE-2025-46686

What it actually does

Authenticated clients can trigger unbounded memory allocation on the server by sending a multi-bulk command containing a large number of bulk elements; the server allocates argument storage for every bulk element before permission checks cause the command to be skipped.

Why it matters to the business

Redis-based services may experience gradual or sudden memory exhaustion, leading to degraded performance, increased infrastructure costs, or unplanned restarts that interrupt dependent applications.

How an attack unfolds

An authenticated user crafts and sends a single multi-bulk command with thousands or millions of small bulk arguments; the server allocates memory for each argument regardless of the subsequent permission denial, allowing the attacker to repeat the pattern and accumulate memory pressure until the process is terminated or the host is impacted.

How to fix it

Upgrade affected GitLab (Bitnami) installations to version 18.0.6 or later, which contains the corrected Redis component; restrict network access to Redis ports and enforce the principle of least privilege for authenticated users until the update is applied.

How to confirm the fix worked

Confirm the running Redis version is 8.0.4 or newer (or the GitLab package containing it), review memory-usage telemetry before and after sending test multi-bulk commands with varying bulk counts, and verify that permission-denied commands no longer cause measurable allocation growth.

Typical attack path

1. Obtain valid low-privilege credentials for the Redis instance
2. Establish a connection and issue a large multi-bulk command containing many bulk elements
3. Repeat the command at a rate sufficient to outpace garbage collection or memory reclamation
4. Monitor server memory metrics until exhaustion occurs and service availability is lost

How to detect it

Search Redis slow-log and INFO memory output for repeated large multi-bulk commands that result in permission-denied replies; correlate with operating-system memory metrics showing steady growth without corresponding data-set size increase.

What your security team should do

• Apply the 18.0.6 GitLab (Bitnami) update within the next maintenance window
• Implement network segmentation so only trusted clients can reach Redis listeners
• Enable Redis command statistics and memory tracking to detect anomalous allocation patterns
• Review and tighten ACLs to ensure only necessary users can execute commands that accept bulk arguments