Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-07-25T00:08:35 redis: Redis: Remote Code Execution via specially crafted RESTORE payload 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CWE-1341

Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer, because deleting both consumers via XGROUP DELCONSUMER leads to a double free. NOTE: this issue exists because of an incomplete fix for CVE-2026-25243.

A flaw was found in Redis. An authenticated attacker, in an unusual configuration where they can execute the RESTORE command, could exploit a double free vulnerability. This occurs when a specially crafted RESTORE payload references the same NACK (pending entry) by multiple consumers, and both consumers are subsequently deleted via XGROUP DELCONSUMER. Successful exploitation of this flaw could lead to remote code execution.

Red Hat Hardened Images 2026-07-22T00:00:00Z RHSA-2026:43236 valkey-main-9.0.5-0.1.hum1 Red Hat Enterprise Linux 10 Affected valkey Red Hat Enterprise Linux 8 Affected redis:6/redis Red Hat Enterprise Linux 9 Affected redis Red Hat Enterprise Linux 9 Affected redis:7/redis Red Hat Enterprise Linux 9 Affected valkey Red Hat Hardened Images Not affected boost https://www.cve.org/CVERecord?id=CVE-2026-66373 https://nvd.nist.gov/vuln/detail/CVE-2026-66373 https://github.com/berabuddies/redis-poc https://github.com/redis/redis/compare/8.6.4...8.8.0 https://github.com/redis/redis/pull/15081 https://news.ycombinator.com/item?id=49024938 https://x.com/Fried_rice/status/2080059356322918777