This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Redis fixes two vulnerabilities

Redis has released versions 8.8.1, 8.6.5, 8.4.5 and 8.2.8 containing fixes for two vulnerabilities. The first one is described below; the second one, which affects the RedisBloom/TDigest module and allows writing outside the bounds of allocated memory, has not yet been assigned a CVE identifier [1]. According to a public PoC [2], there is also a third vulnerability in RedisBloom/TopK, for which no fix has been released yet. In addition to updating to the highest fixed version for the deployed branch, given the absence of a fix for the third vulnerability, a temporary mitigation is also recommended: removing the RESTORE permission from accounts that do not strictly require it and restricting network access to Redis to trusted sources only; see the temporary fix procedure for the similar vulnerability CVE-2026-25243 [3][4].

Redis - RCE (CVE-2026-66373)
CVSS 7.5 (High)

An authenticated remote attacker with access to the RESTORE command can, under certain conditions, corrupt memory and potentially execute code using a specially crafted payload. The vulnerability arose from an incomplete fix of CVE-2026-25243 [5]. A PoC is available at [2].

The vulnerability is present in product:

  • Redis; <6.2.23; >=7.0, <7.2.15; >=7.4, <7.4.10; >=8.0, <8.2.8; >=8.4, <8.4.5; >=8.6, <8.6.5;

CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 24. 7. 2026.

By CESNET, z.s.p.o. Michaela Ručková on 27. 7. 2026.

CESNET, z.s.p.o. Logo