7.5
High
CVE-2026-66373 Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code…
Description
Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer, because deleting both consumers via XGROUP DELCONSUMER leads to a double free. NOTE: this issue exists because of an incomplete fix for CVE-2026-25243.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Redis 8.8 | earliest → < 8.8.0 | 8.8.0 |
References
- github.com github.com
- github.com github.com
- x.com x.com
- github.com github.com
- news.ycombinator.com news.ycombinator.com
Timeline
- Published
- Last modified
Other CVEs of Redis
The 50 CVEs of Redis →
CVE-2026-81934
Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS…
7.1
High
CVE-2026-72568
An out-of-bounds read vulnerability in Redis through 8.8.1 allows an adjacent unauthenticated attacker to cause denial…
7.1
High
CVE-2026-25243
Redis is an in-memory data structure store
7.7
High
CVE-2026-23631
Redis is an in-memory data structure store
6.1
Medium