Описание
Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This is patched in version 8.6.3.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| redict | unfixed | package | ||
| redis | fixed | 5:8.6.3-1 | experimental | package |
| redis | fixed | 5:8.0.6-3 | package | |
| redis | not-affected | bullseye | package | |
| valkey | fixed | 9.1.1-1 | package |
Примечания
https://github.com/redis/redis/security/advisories/GHSA-c8h9-259x-jff4
https://www.zeroday.cloud/blog/redis-cve-2026-25243-deep-dive
Fixed by: https://github.com/redis/redis/commit/b9dde6fc25dec6191b18374335a076a7b31e3d02 (8.6.3)
When fixing this issue make the fix complete with the followups for CVE-2026-66373 to
open up CVE-2026-66373.
valkey is affected as well, zipmapValidateIntegrity() lacks the overlong length-encoding
check; ASan heap-buffer-overflow in zipmapDecodeLength() on 8.1.1+dfsg1-3+deb13u2.
https://github.com/valkey-io/valkey/pull/3619
valkey fixed by: https://github.com/valkey-io/valkey/commit/fea0b4064cf612d1c365b032326832bff0946bd9 (8.1.7)
EPSS
Связанные уязвимости
Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This is patched in version 8.6.3.
Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This is patched in version 8.6.3.
Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This is patched in version 8.6.3.
redis-server RESTORE invalid memory access may allow remote code execution
EPSS