Remote Code Execution Vulnerability in Redis by Redis Labs

CVE-2026-66373

What is CVE-2026-66373?

CVE-2026-66373 represents a critical remote code execution vulnerability in Redis, an in-memory data structure store widely used for caching and database operations. Specifically, this vulnerability affects versions of Redis prior to 8.8.0 and arises when an authenticated attacker executes the RESTORE command under certain conditions. This situation can occur when multiple consumers reference the same NACK (pending entry). By using a RESTORE payload strategically, an attacker can exploit a double free condition triggered by the XGROUP DELCONSUMER command, leading to the potential execution of arbitrary code on the server. The vulnerability is of particular concern as it allows attackers to execute code remotely, compromising the integrity and confidentiality of the affected systems.

Potential impact of CVE-2026-66373

1. Remote Code Execution: The most significant impact of CVE-2026-66373 is the ability for an attacker to execute arbitrary code on the affected Redis server. This control can enable the adversary to manipulate data, install malware, or disseminate further attacks within the network.

2. Data Compromise: Exploiting this vulnerability may result in unauthorized access to sensitive data stored in Redis. Given that Redis is often used for caching and Session management in web applications, attackers could potentially retrieve or alter critical user information, leading to severe privacy breaches.

3. Service Disruption: The manipulation of Redis instances through this vulnerability can lead to service disruptions, denial of service conditions, or cascading failures in applications that rely on Redis for operations. This can adversely affect business continuity, resulting in potential financial losses.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

This is an advertDeploy the Patch →

References