VYPR
← All advisories
Unrated severityOSV Advisory· Published Jul 27, 2026

Debian redis: Redis before 8.8.0, in the unusual case where an authenticated attacker can exec…

CVE-2026-66373

Description

Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer, because deleting both consumers via XGROUP DELCONSUMER leads to a double free. NOTE: this issue exists because of an incomplete fix for CVE-2026-25243.

Affected products

2
  • Redis/RedisOSV2 versions
    8.8-rc1, 8.8-m03, 8.8-m02, …+ 1 more
    • (no CPE)range: 8.8-rc1, 8.8-m03, 8.8-m02, …
    • (no CPE)range: <8.8.0

Patches

Vulnerability mechanics

News mentions

0

No linked articles in our index yet.