high CVSS 8.5

CVE-2026-66373·Redis vulnerability

Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer, because deleting both consumers via XGROUP DELCONSUMER leads to a double free. NOTE: this issue exists because of an incomplete fix for CVE-2026-25243.

Severity
high
Software
Redis
Fixed in
5:7.0.15-1~deb12u9
Published

Affected versions

Until: 5:7.0.15-1~deb12u9

Fixed in: 5:7.0.15-1~deb12u9

How to fix this CVE

Upgrade Redis to version 7.0.15-1~deb12u9 or later to remediate this memory corruption vulnerability. The vulnerability requires authenticated access and specific conditions involving stream consumer groups, but poses a critical remote code execution risk. Apply the patch immediately across all Redis instances in your infrastructure, particularly those accepting remote connections.

sudo dnf update redis

Defensia detects this vulnerability

How to check if you are affected

  1. Step 1: Check installed Redis version with `redis-cli --version` or `redis-server --version` and compare against 7.0.15-1~deb12u9
  2. Step 2: Verify Redis ACL configuration by running `redis-cli ACL LIST` to identify users with RESTORE command permissions
  3. Step 3: Query Redis command history with `redis-cli COMMAND INFO RESTORE XGROUP DELCONSUMER` to check if these commands are accessible to non-admin accounts
  4. Step 4: After patching, confirm the update with `redis-cli INFO server` and verify the version string reflects the fixed version

FAQ

What is CVE-2026-66373?

This vulnerability is a double-free memory corruption bug in Redis that occurs when a stream consumer group references the same pending entry (NACK) through multiple consumers, and both are deleted via XGROUP DELCONSUMER. An authenticated attacker can exploit this through a malformed RESTORE payload to achieve remote code execution.

Is CVE-2026-66373 being actively exploited?

No, according to CISA's Known Exploited Vulnerabilities catalog, CVE-2026-66373 is not currently being exploited in the wild, and no public exploits are available.

What versions of Redis are affected by CVE-2026-66373?

All versions prior to 7.0.15-1~deb12u9 are affected. This includes Redis 7.0.x and earlier branches. The vulnerability was introduced as an incomplete fix for a prior issue (CVE-2026-25243).

How do I check if my server is vulnerable to CVE-2026-66373?

Run `redis-cli --version` or `redis-server --version` and compare the version string to 7.0.15-1~deb12u9. If your version is older, the instance is vulnerable.

Does Defensia detect CVE-2026-66373?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If Redis is installed on a monitored server, CVE-2026-66373 will appear in your dashboard with remediation steps.

Related Redis CVEs

CVE-2022-0543CVSS 10It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.
CVE-2026-23479CVSS 8.8Redis is an in-memory data structure store. In redis-server from 7.2.0 until 8.6.3, the unblock client flow does not handle an error return from `processCommandAndResetClient` when re-executing a blocked command. If a blocked client is evicted during this flow, an authenticated attacker can trigger a use-after-free that may lead to remote code execution. This has been patched in version 8.6.3.
CVE-2026-25243CVSS 8.8Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This is patched in version 8.6.3.
CVE-2018-12326CVSS 8.5Buffer overflow in redis-cli of Redis before 4.0.10 and 5.x before 5.0 RC3 allows an attacker to achieve code execution and escalate to higher privileges via a crafted command line. NOTE: It is unclear whether there are any common situations in which redis-cli is used with, for example, a -h (aka hostname) argument from an untrusted source.
CVE-2026-23631CVSS 8.1Redis is an in-memory data structure store. In all versions of redis-server with Lua scripting, an authenticated attacker can exploit the master-replica synchronization mechanism to trigger a use-after-free on replicas where replica-read-only is disabled or can be disabled, which may lead to remote code execution. A workaround is to prevent users from executing Lua scripts or avoid using replicas where replica-read-only is disabled. This is patched in version 8.6.3.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-66373. Free for 1 server.

Get started free