CVE-2026-66373 in Redis
Summary
by MITRE • 07/25/2026
Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer, because deleting both consumers via XGROUP DELCONSUMER leads to a double free. NOTE: this issue exists because of an incomplete fix for CVE-2026-25243.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/25/2026
This vulnerability represents a critical remote code execution flaw in Redis versions prior to 8.8.0 that arises from a specific condition involving authenticated attackers with RESTORE command access. The technical root cause stems from improper memory management within the stream consumer group implementation, where a double free vulnerability occurs when multiple consumers reference the same pending entry. This issue is particularly insidious because it requires an authenticated attacker who already possesses credentials to execute RESTORE commands, but the impact extends beyond simple privilege escalation to full system compromise.
The vulnerability manifests through the interaction between XGROUP DELCONSUMER operations and the underlying memory management of stream entries. When an attacker executes RESTORE with malicious payloads that create multiple consumer references to identical pending entries, subsequent deletion of these consumers triggers a double free condition in the Redis memory allocator. This fundamental memory corruption allows arbitrary code execution on the affected system, as demonstrated by the incomplete fix for CVE-2026-25243 which failed to address all possible pathways leading to the same underlying memory management flaw.
From an operational perspective, this vulnerability presents a severe risk to Redis deployments where authentication is not adequately enforced or where privileged accounts are compromised. The requirement for authenticated access reduces the attack surface compared to fully unauthenticated exploits, but the remote code execution capability makes it particularly dangerous in environments where Redis serves as a critical backend service. Organizations using Redis in production environments must consider this vulnerability as a high-priority concern due to its potential for complete system compromise.
The technical characteristics of this vulnerability align with CWE-415 and CWE-416, which address double free conditions and memory management errors respectively. The ATT&CK framework categorizes this as a privilege escalation technique through memory corruption, potentially leading to lateral movement and persistence within compromised environments. Mitigation strategies should focus on immediate patching to Redis 8.8.0 or later versions, along with implementing strict network segmentation to limit access to Redis instances and enforcing robust authentication mechanisms. Organizations should also consider monitoring for unusual RESTORE command usage patterns and implementing proper access controls to minimize the risk of authenticated attackers exploiting this vulnerability.