CVE-2026-66373
Received Received - Intake

Redis Remote Code Execution via RESTORE Double Free

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: MITRE

Description
Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer, because deleting both consumers via XGROUP DELCONSUMER leads to a double free. NOTE: this issue exists because of an incomplete fix for CVE-2026-25243.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-07-25
AI Q&A
2026-07-25
EPSS Evaluated
N/A
NVD
CVE-2026-66373
EUVD
EUVD-2026-48762

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
redis redis to 8.8.0 (exc)
redis redis 6.2.22
redis redis 7.4.9
redis redis 8.6.4
redis redis 8.8.0
redis redis 8.8.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-415 The product calls free() twice on the same memory address.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-66373 is a vulnerability in Redis versions before 8.8.0 where an authenticated attacker can execute RESTORE commands. The issue arises when a RESTORE payload references the same NACK (pending entry) by multiple consumers, leading to a double free when both consumers are deleted via XGROUP DELCONSUMER. This results in remote code execution due to memory corruption.

Detection Guidance

Detecting this vulnerability requires checking Redis versions and monitoring for corrupt stream RDB payloads. Use commands like 'redis-cli INFO server' to check the Redis version. If using vulnerable versions (6.2.22, 7.4.9, 8.6.4, 8.8.0/8.8.1), inspect stream data structures for duplicate NACK references. Commands like 'XINFO STREAM <key>' can help analyze streams for corruption.

Impact Analysis

If exploited, this vulnerability allows authenticated attackers to execute arbitrary code on the Redis server. This could lead to data breaches, unauthorized access to sensitive information, or disruption of services. The impact depends on the server's configuration and the attacker's goals.

  • Unauthorized code execution on the Redis server.
  • Potential data theft or corruption.
  • Service disruption or denial of service.
Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations may face fines, legal penalties, and reputational damage if such incidents occur due to non-compliance with these regulations.

Mitigation Strategies

Upgrade Redis to version 8.8.0 or later immediately. If upgrading is not possible, apply the patch from the Redis GitHub PR #15081. Disable RESTORE commands if not required. Restrict Redis access to trusted networks only. Monitor for unusual activity in stream data structures.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66373. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart