High severity8.8NVD Advisory· Published May 5, 2026· Updated Jul 25, 2026
CVE-2026-25243
CVE-2026-25243
Description
Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This is patched in version 8.6.3.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
18- Range: <=8.6.3
- osv-coords15 versionspkg:apk/chainguard/py3-redispkg:apk/chainguard/py3.10-redispkg:apk/chainguard/py3.11-redispkg:apk/chainguard/py3.12-redispkg:apk/chainguard/py3.13-redispkg:bitnami/keydbpkg:bitnami/redispkg:bitnami/valkeypkg:rpm/almalinux/redispkg:rpm/almalinux/redis-develpkg:rpm/almalinux/redis-docpkg:rpm/almalinux/valkeypkg:rpm/almalinux/valkey-develpkg:rpm/opensuse/redis&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/valkey&distro=openSUSE%20Tumbleweed
< 0+ 14 more
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 6.2.22
- (no CPE)range: < 6.2.22
- (no CPE)range: < 7.2.13
- (no CPE)range: < 6.2.22-1.el9_8
- (no CPE)range: < 6.2.22-1.el9_8
- (no CPE)range: < 6.2.22-1.el9_8
- (no CPE)range: < 8.0.9-1.el10_2
- (no CPE)range: < 8.0.9-1.el10_2
- (no CPE)range: < 8.6.3-1.1
- (no CPE)range: < 9.0.4-1.1
Patches
Vulnerability mechanics
References
20- github.com/redis/redis/security/advisories/GHSA-c8h9-259x-jff4nvdMitigationVendor Advisory
- github.com/redis/redis/releases/tag/8.6.3nvdRelease Notes
- access.redhat.com/errata/RHSA-2026:14316nvd
- access.redhat.com/errata/RHSA-2026:23229nvd
- access.redhat.com/errata/RHSA-2026:25216nvd
- access.redhat.com/errata/RHSA-2026:25219nvd
- access.redhat.com/errata/RHSA-2026:25925nvd
- access.redhat.com/errata/RHSA-2026:26008nvd
- access.redhat.com/errata/RHSA-2026:26233nvd
- access.redhat.com/errata/RHSA-2026:26306nvd
- access.redhat.com/errata/RHSA-2026:26540nvd
- access.redhat.com/errata/RHSA-2026:27716nvd
- access.redhat.com/errata/RHSA-2026:27787nvd
- access.redhat.com/errata/RHSA-2026:28139nvd
- access.redhat.com/errata/RHSA-2026:28142nvd
- access.redhat.com/errata/RHSA-2026:29817nvd
- access.redhat.com/errata/RHSA-2026:33427nvd
- access.redhat.com/security/cve/CVE-2026-25243nvd
- bugzilla.redhat.com/show_bug.cginvd
- security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25243.jsonnvd
News mentions
3- Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers SayThe Hacker News · Jul 24, 2026
- ⚡ Weekly Recap: Instagram Account Hacks, Android Zero-Day, GitHub Worm and MoreThe Hacker News · Jun 8, 2026
- Patch Tuesday - May 2026Rapid7 Blog · May 13, 2026