Skip to content
Fencer Vulns
high 8.8

CVE-2026-25243 json

redis-server RESTORE invalid memory access may allow remote code execution

published 2026-05-05 6 mo ago modified 2026-09-08 2 mo ago also BIT-keydb-2026-25243 , BIT-redis-2026-25243 , BIT-valkey-2026-25243 , EUVD-2026-27410 , GHSA-c8h9-259x-jff4

cvss
8.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
4.0%
EPSS 4.0% chance of exploitation in 30 days, percentile 90%
public exploits
0
none known

Summary

Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This is patched in version 8.6.3.

Patch / fix

  • bitnami keydb 6.2.22, 7.2.14, 7.4.9, 8.2.6, 8.4.3, 8.6.3
  • bitnami redis 6.2.22, 7.2.14, 7.4.9, 8.2.6, 8.4.3, 8.6.3
  • bitnami valkey 7.2.13, 8.0.8, 8.1.7, 9.0.4
  • Red Hat Red Hat Enterprise Linux 10 0:8.0.9-1.el10_2
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support 0:8.0.9-1.el10_0
  • Red Hat Red Hat Enterprise Linux 8 8100020260522105353.489197e6
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 8040020260618162855.522a0ee4
  • Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 8040020260618162855.522a0ee4
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 8060020260623095617.ad008a3a
  • Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On 8060020260623095617.ad008a3a
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service 8080020260626132343.63b34585
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 8080020260626132343.63b34585
  • Red Hat Red Hat Enterprise Linux 9 0:6.2.22-1.el9_8, 0:8.0.9-1.el9_8, 9080020260521083756.9
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 0:6.2.7-1.el9_2.6
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 0:6.2.7-1.el9_4.6, 9040020260618054637.9
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support 0:6.2.22-1.el9_6, 9060020260602115714.9
  • Red Hat Red Hat Hardened Images 9.0.4-0.1.hum1
  • redis Debian 12 5:7.0.15-1~deb12u8
  • redis Debian 13 5:8.0.2-3+deb13u3
  • redis Debian 14 5:8.0.6-3
  • valkey Debian 13 8.1.1+dfsg1-3+deb13u3
  • valkey Debian 14 9.1.1-1

debian advisories DEBIAN-CVE-2026-25243

  • valkey hummingbird 1 9.0.4-0.1.hum1
  • valkey-rdma hummingbird 1 9.0.4-0.1.hum1
  • valkey-compat-redis hummingbird 1 9.0.4-0.1.hum1
  • redis RHEL 8 6.2.22-1.module+el8.10.0+24332+dbd3b426
  • valkey RHEL 9 8.0.9-1.el9_8
  • redis RHEL 9 7.2.14-1.module+el9.8.0+24327+41ceb644
  • valkey RHEL 10.2 8.0.9-1.el10_2
  • redis RHEL 9 6.2.22-1.el9_8

red hat advisories RHSA-2026:14316RHSA-2026:33427RHSA-2026:29817RHSA-2026:28139RHSA-2026:28142RHSA-2026:27787

  • redis openSUSE Leap 16.0 8.10.1-bp160.1.1
  • redis-modules openSUSE Leap 16.0 8.10.1-bp160.1.1
  • valkey openSUSE Tumbleweed 9.0.4-1.1
  • redis openSUSE Tumbleweed 8.6.3-1.1

opensuse advisories openSUSE-SU-2026:21612-1openSUSE-SU-2026:10719-1openSUSE-SU-2026:10711-1

  • valkey AlmaLinux 9 8.0.9-1.el9_8
  • redis AlmaLinux 8 6.2.22-1.module_el8.10.0+4197+3446deec
  • valkey AlmaLinux 10 8.0.9-1.el10_2
  • redis AlmaLinux 9 7.2.14-1.module_el9.8.0+258+b8f945d3
  • redis AlmaLinux 9 6.2.22-1.el9_8

almalinux advisories ALSA-2026:25925ALSA-2026:26008ALSA-2026:25216ALSA-2026:25219ALSA-2026:23229

  • valkey Rocky Linux 9 8.0.9-1.el9_8
  • redis Rocky Linux 8 6.2.22-1.module+el8.10.0+40211+0d1d5c90
  • valkey Rocky Linux 10 8.0.9-1.el10_2
  • redis Rocky Linux 9 7.2.14-1.module+el9.8.0+40207+e2014501
  • redis Rocky Linux 9 6.2.22-1.el9_8

rocky linux advisories RLSA-2026:25925RLSA-2026:26008RLSA-2026:25216RLSA-2026:25219RLSA-2026:23229

  • valkey Alpine 3.21, Alpine 3.20 7.2.13-r0
  • valkey Alpine 3.22 8.1.7-r0
  • valkey Alpine 3.24, Alpine 3.23 9.0.4-r0

alpine advisories ALPINE-CVE-2026-25243

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • valkey Azure Linux 3.0 8.0.9-1

azure linux advisories AZL-86081

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-25243 updated cvss 8.8

redis: RESTORE invalid memory access may allow remote code execution

  • Red Hat Enterprise Linux AppStream (v. 8) redis 6.2.22-1.module+el8.10.0+24332+dbd3b426
    fixed: vendor fix “To mitigate this flaw, restrict the execution privileges of the RESTORE command exclusively to highly trusted and administrative users by using the appropriate ACL rules.” RHSA-2026:26008
  • Red Hat Enterprise Linux AppStream (v. 9) redis 6.2.22-1.el9_8, valkey 8.0.9-1.el9_8, redis 7.2.14-1.module+el9.8.0+24327+41ceb644
    fixed: vendor fix “To mitigate this flaw, restrict the execution privileges of the RESTORE command exclusively to highly trusted and administrative users by using the appropriate ACL rules.” RHSA-2026:23229
  • Red Hat Enterprise Linux AppStream (v. 10) valkey 8.0.9-1.el10_2
    fixed: vendor fix “To mitigate this flaw, restrict the execution privileges of the RESTORE command exclusively to highly trusted and administrative users by using the appropriate ACL rules.” RHSA-2026:25216
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) redis 6.0.9-5.module+el8.4.0+24416+a7ffbc5f.6
    fixed: vendor fix “To mitigate this flaw, restrict the execution privileges of the RESTORE command exclusively to highly trusted and administrative users by using the appropriate ACL rules.” RHSA-2026:27787
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) redis 6.0.9-5.module+el8.6.0+24434+c7b1e4bc.7
    fixed: vendor fix “To mitigate this flaw, restrict the execution privileges of the RESTORE command exclusively to highly trusted and administrative users by using the appropriate ACL rules.” RHSA-2026:29817
  • Red Hat Enterprise Linux AppStream E4S (v.8.8) redis 6.2.7-1.module+el8.8.0+24465+9d14ca70.7
    fixed: vendor fix “To mitigate this flaw, restrict the execution privileges of the RESTORE command exclusively to highly trusted and administrative users by using the appropriate ACL rules.” RHSA-2026:33427
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) redis 6.2.7-1.el9_2.6
    fixed: vendor fix “To mitigate this flaw, restrict the execution privileges of the RESTORE command exclusively to highly trusted and administrative users by using the appropriate ACL rules.” RHSA-2026:27716
  • Red Hat Enterprise Linux AppStream E4S (v.9.4) redis 6.2.7-1.el9_4.6, redis 7.0.12-2.module+el9.4.0+24422+b373a9c6.7
    fixed: vendor fix “To mitigate this flaw, restrict the execution privileges of the RESTORE command exclusively to highly trusted and administrative users by using the appropriate ACL rules.” RHSA-2026:28139
show 7 more
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) valkey 8.0.9-1.el10_0
    fixed: vendor fix “To mitigate this flaw, restrict the execution privileges of the RESTORE command exclusively to highly trusted and administrative users by using the appropriate ACL rules.” RHSA-2026:26540
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) redis 6.2.22-1.el9_6, redis 7.2.14-1.module+el9.6.0+24344+1bc33ec7
    fixed: vendor fix “To mitigate this flaw, restrict the execution privileges of the RESTORE command exclusively to highly trusted and administrative users by using the appropriate ACL rules.” RHSA-2026:26233
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) redis 6.0.9-5.module+el8.4.0+24416+a7ffbc5f.6
    fixed: vendor fix “To mitigate this flaw, restrict the execution privileges of the RESTORE command exclusively to highly trusted and administrative users by using the appropriate ACL rules.” RHSA-2026:27787
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) redis 6.0.9-5.module+el8.6.0+24434+c7b1e4bc.7
    fixed: vendor fix “To mitigate this flaw, restrict the execution privileges of the RESTORE command exclusively to highly trusted and administrative users by using the appropriate ACL rules.” RHSA-2026:29817
  • Red Hat Enterprise Linux AppStream TUS (v.8.8) redis 6.2.7-1.module+el8.8.0+24465+9d14ca70.7
    fixed: vendor fix “To mitigate this flaw, restrict the execution privileges of the RESTORE command exclusively to highly trusted and administrative users by using the appropriate ACL rules.” RHSA-2026:33427
  • Red Hat Hardened Images valkey 9.0.4-0.1.hum1, valkey-compat-redis 9.0.4-0.1.hum1
    fixed: vendor fix “To mitigate this flaw, restrict the execution privileges of the RESTORE command exclusively to highly trusted and administrative users by using the appropriate ACL rules.” RHSA-2026:14316
  • Red Hat Hardened Images boost 1.90.0-7.hum1
    not affected: vulnerable code not in execute path

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
6 mo ago

Exploit prediction

4.03% chance of exploitation in the next 30 days, higher than 90% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 7.7 CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADP 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA 4.0 7.7 CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
bitnami keydb
<6.2.22
>=7.0.0, <7.2.14
>=7.3.0, <7.4.9
>=8.0.0, <8.2.6
>=8.3.0, <8.4.3
>=8.5.0, <8.6.3
6.2.22
7.2.14
7.4.9
8.2.6
8.4.3
8.6.3
bitnami redis
<6.2.22
>=7.0.0, <7.2.14
>=7.3.0, <7.4.9
>=8.0.0, <8.2.6
>=8.3.0, <8.4.3
>=8.5.0, <8.6.3
6.2.22
7.2.14
7.4.9
8.2.6
8.4.3
8.6.3
bitnami valkey
<7.2.13
>=8.0.0, <8.0.8
>=8.1.0, <8.1.7
>=9.0.0, <9.0.4
7.2.13
8.0.8
8.1.7
9.0.4

Affected products

  • redis redis
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support
  • Red Hat Red Hat Hardened Images

Classification

Weakness
  • CWE-122 Heap-based Buffer Overflow
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

The maintainers of redis/redis published their own advisory on GitHub. Reviewed sources take precedence over it.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.