In-memory Data Structure Store Vulnerability in Redis by Redis Labs
CVE-2026-25243

7.7HIGH

Key Information:

Vendor

Redis

Status
Redis
Vendor
CVE Published:
5 May 2026

What is CVE-2026-25243?

Redis, a widely used in-memory data structure store, is impacted by a vulnerability in its RESTORE command. This flaw allows authenticated attackers with permissions to execute the RESTORE command to manipulate serialized payloads, leading to potential memory access issues that can result in remote code execution. Users are advised to implement ACL (Access Control List) rules to limit access to this command as a precautionary measure. The issue is addressed in the latest release, version 8.6.3.

Affected Version(s)

redis < 8.6.3

References

https://github.com/redis/redis/security/advisories/GHSA-c...
x_refsource_CONFIRM
https://github.com/redis/redis/releases/tag/8.6.3
x_refsource_MISC

CVSS V4

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.