Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

rocky логотип

RLSA-2026:65120

Опубликовано: 09 сент. 2026
Источник: rocky
Оценка: Important

Описание

Important: redis:7 security update

Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, or by appending each command to a log.

Security Fix(es):

  • redis: Redis: Remote Code Execution via specially crafted RESTORE payload (CVE-2026-66373)

  • redis: Redis: Denial of Service via Out-of-Bounds Read in Cluster Bus (CVE-2026-72568)

  • redis: Redis: Arbitrary code execution via TLS pending-data list use-after-free (CVE-2026-81934)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Затронутые продукты

  • Rocky Linux 9

НаименованиеАрхитектураРелизRPM
redisaarch641.module+el9.8.0+40315+e15874a8redis-7.2.16-1.module+el9.8.0+40315+e15874a8.aarch64.rpm
redis-develaarch641.module+el9.8.0+40315+e15874a8redis-devel-7.2.16-1.module+el9.8.0+40315+e15874a8.aarch64.rpm
redis-docnoarch1.module+el9.8.0+40315+e15874a8redis-doc-7.2.16-1.module+el9.8.0+40315+e15874a8.noarch.rpm
redisx86_641.module+el9.8.0+40315+e15874a8redis-7.2.16-1.module+el9.8.0+40315+e15874a8.x86_64.rpm
redis-develx86_641.module+el9.8.0+40315+e15874a8redis-devel-7.2.16-1.module+el9.8.0+40315+e15874a8.x86_64.rpm

Показывать по

Связанные уязвимости

oracle-oval
8 дней назад

ELSA-2026-65120-0: redis:7 security update (IMPORTANT)

rocky
7 дней назад

Important: redis security, bug fix, and enhancement update

rocky
7 дней назад

Important: redis:6 security update

oracle-oval
8 дней назад

ELSA-2026-64823-0: redis:6 security update (IMPORTANT)

CVSS3: 7.5
ubuntu
около 2 месяцев назад

Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer, because deleting both consumers via XGROUP DELCONSUMER leads to a double free. NOTE: this issue exists because of an incomplete fix for CVE-2026-25243.