Описание
Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer, because deleting both consumers via XGROUP DELCONSUMER leads to a double free. NOTE: this issue exists because of an incomplete fix for CVE-2026-25243.
A flaw was found in Redis. An authenticated attacker, in an unusual configuration where they can execute the RESTORE command, could exploit a double free vulnerability. This occurs when a specially crafted RESTORE payload references the same NACK (pending entry) by multiple consumers, and both consumers are subsequently deleted via XGROUP DELCONSUMER. Successful exploitation of this flaw could lead to remote code execution.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Hardened Images | boost | Not affected | ||
| Red Hat Enterprise Linux 10 | valkey | Fixed | RHSA-2026:64796 | 08.09.2026 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | valkey | Fixed | RHSA-2026:68601 | 17.09.2026 |
| Red Hat Enterprise Linux 8 | redis | Fixed | RHSA-2026:64823 | 08.09.2026 |
| Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | redis | Fixed | RHSA-2026:69542 | 21.09.2026 |
| Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | redis | Fixed | RHSA-2026:69542 | 21.09.2026 |
| Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | redis | Fixed | RHSA-2026:69534 | 21.09.2026 |
| Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On | redis | Fixed | RHSA-2026:69534 | 21.09.2026 |
| Red Hat Enterprise Linux 8.8 Telecommunications Update Service | redis | Fixed | RHSA-2026:69533 | 21.09.2026 |
| Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | redis | Fixed | RHSA-2026:69533 | 21.09.2026 |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer, because deleting both consumers via XGROUP DELCONSUMER leads to a double free. NOTE: this issue exists because of an incomplete fix for CVE-2026-25243.
Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer, because deleting both consumers via XGROUP DELCONSUMER leads to a double free. NOTE: this issue exists because of an incomplete fix for CVE-2026-25243.
Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer, because deleting both consumers via XGROUP DELCONSUMER leads to a double free. NOTE: this issue exists because of an incomplete fix for CVE-2026-25243.
Redis before 8.8.0, in the unusual case where an authenticated attacke ...
EPSS
7.5 High
CVSS3