high 7.5

CVE-2026-66373 json

Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE pay…

published 2026-07-25 3 mo ago modified 2026-09-09 1 mo ago also EUVD-2026-48762

cvss: 7.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.9%; EPSS 0.9% chance of exploitation in 30 days, percentile 59%
public exploits: 0; none known

Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer, because deleting both consumers via XGROUP DELCONSUMER leads to a double free. NOTE: this issue exists because of an incomplete fix for CVE-2026-25243.

Patch / fix

fixed in 1 distros 5 links 1

Redis Redis 8.8.0

debian red hat suse almalinux rocky linux

redis Debian 12 5:7.0.15-1~deb12u9

debian advisories DEBIAN-CVE-2026-66373

redis RHEL 9 7.2.16-1.module+el9.8.0+24745+654dcf03
redis RHEL 9 6.2.24-1.el9_8
redis RHEL 8 6.2.24-1.module+el8.10.0+24746+7b800ac5
valkey RHEL 9 8.0.10-1.el9_8
valkey RHEL 10.2 8.0.11-1.el10_2
valkey hummingbird 1 9.0.5-0.1.hum1
valkey-rdma hummingbird 1 9.0.5-0.1.hum1
valkey-compat-redis hummingbird 1 9.0.5-0.1.hum1

red hat advisories RHSA-2026:69862 RHSA-2026:69861 RHSA-2026:69542 RHSA-2026:69533 RHSA-2026:69534 RHSA-2026:69521

redis SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +5 more 6.2.6-150400.3.49.1
redis7 SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE High Performance Computing 15 SP5-LTSS +1 more 7.0.8-150500.3.34.1
redis7 SLES for SAP 15 SP6, SLES 15 SP6-LTSS 7.0.8-150600.8.28.1
redis SLES for SAP 15 SP6, SLES 15 SP6-LTSS 7.2.4-150600.3.27.1

suse advisories SUSE-SU-2026:3639-1 SUSE-SU-2026:3638-1 SUSE-SU-2026:3637-1 SUSE-SU-2026:3636-1

valkey AlmaLinux 10 8.0.11-1.el10_2
valkey AlmaLinux 9 8.0.10-1.el9_8
redis AlmaLinux 8 6.2.24-1.module_el8.10.0+4271+7f8f19af
redis AlmaLinux 9 6.2.24-1.el9_8

almalinux advisories ALSA-2026:64796 ALSA-2026:64807 ALSA-2026:64823 ALSA-2026:64824

valkey Rocky Linux 10 8.0.11-1.el10_2
valkey Rocky Linux 9 8.0.10-1.el9_8
redis Rocky Linux 9 6.2.24-1.el9_8
redis Rocky Linux 9 7.2.16-1.module+el9.8.0+40315+e15874a8
redis Rocky Linux 8 6.2.24-1.module+el8.10.0+40313+282db117

rocky linux advisories RLSA-2026:64796 RLSA-2026:64807 RLSA-2026:64824 RLSA-2026:65120 RLSA-2026:64823

github.com/redis/redis#15081 pull request

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-66373 updated 2026-09-22 cvss 7.5

redis: Redis: Remote Code Execution via specially crafted RESTORE payload

Red Hat Enterprise Linux AppStream (v. 8) redis 6.2.24-1.module+el8.10.0+24746+7b800ac5
fixed: vendor fix RHSA-2026:64823
Red Hat Enterprise Linux AppStream (v. 9) redis 6.2.24-1.el9_8, valkey 8.0.10-1.el9_8, redis 7.2.16-1.module+el9.8.0+24745+654dcf03
fixed: vendor fix RHSA-2026:64824
Red Hat Enterprise Linux AppStream (v. 10) valkey 8.0.11-1.el10_2
fixed: vendor fix RHSA-2026:64796
Red Hat Enterprise Linux AppStream AUS (v.8.4) redis 6.0.9-5.module+el8.4.0+24914+3cb9e211.7
fixed: vendor fix RHSA-2026:69542
Red Hat Enterprise Linux AppStream AUS (v.8.6) redis 6.0.9-5.module+el8.6.0+24913+caade4b4.8
fixed: vendor fix RHSA-2026:69534
Red Hat Enterprise Linux AppStream E4S (v.8.8) redis 6.2.7-1.module+el8.8.0+24912+36dda224.8
fixed: vendor fix RHSA-2026:69533
Red Hat Enterprise Linux AppStream E4S (v.9.2) redis 6.2.7-1.el9_2.7
fixed: vendor fix RHSA-2026:69862
Red Hat Enterprise Linux AppStream E4S (v.9.4) redis 6.2.7-1.el9_4.7, redis 7.0.12-2.module+el9.4.0+24911+6845972a.9
fixed: vendor fix RHSA-2026:69861

show 7 more

Red Hat Enterprise Linux AppStream EUS (v. 10.0) valkey 8.0.11-1.el10_0
fixed: vendor fix RHSA-2026:68601
Red Hat Enterprise Linux AppStream EUS (v.9.6) redis 6.2.24-1.el9_6, redis 7.2.16-1.module+el9.6.0+24910+8b24772d
fixed: vendor fix RHSA-2026:67461
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) redis 6.0.9-5.module+el8.4.0+24914+3cb9e211.7
fixed: vendor fix RHSA-2026:69542
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) redis 6.0.9-5.module+el8.6.0+24913+caade4b4.8
fixed: vendor fix RHSA-2026:69534
Red Hat Enterprise Linux AppStream TUS (v.8.8) redis 6.2.7-1.module+el8.8.0+24912+36dda224.8
fixed: vendor fix RHSA-2026:69533
Red Hat Hardened Images valkey 9.0.5-0.1.hum1, valkey-compat-redis 9.0.5-0.1.hum1
fixed: vendor fix RHSA-2026:43236
Red Hat Hardened Images boost 1.90.0-13.hum1
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: total
Assessed: 3 mo ago (2026-07-27)

Exploit prediction

0.87% chance of exploitation in the next 30 days, higher than 59% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/berabuddies/redis-poc referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Redis Redis

Classification

Weakness

CWE-415 Double Free

Technology feeds

Redis rss critical rss

References

Sources

CVE List CVE-2026-66373
NVD CVE-2026-66373

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary