REDHAT-BUG-2506985: Double Free

Q: Who can exploit this issue?

An authenticated attacker must be able to execute the Redis RESTORE command. The vulnerable condition involves a crafted RESTORE payload that references the same pending entry from more than one consumer.

Q: Which deployments should be considered exposed?

Redis versions before 8.8.0 should be considered affected if authenticated users can execute RESTORE. The provided information does not state whether RESTORE is available in a default configuration.

Q: How can I determine whether an instance is at risk?

Identify Redis instances running a version earlier than 8.8.0, then review which authenticated users or application identities can execute RESTORE. Instances meeting both conditions are exposed to this attack path.

Published Jul 25, 2026

Updated

Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer, because deleting both consumers via XGROUP DELCONSUMER leads to a double free. NOTE: this issue exists because of an incomplete fix for CVE-2026-25243.

Affected Software

1 affected component

Redis redis<8.8.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Redis to a version that resolves this vulnerability.
Fixed in 8.8.0

Event History

Jul 25, 2026

Data Sourced

via Red Hat·01:01 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who can exploit this issue?

An authenticated attacker must be able to execute the Redis RESTORE command. The vulnerable condition involves a crafted RESTORE payload that references the same pending entry from more than one consumer.

Which deployments should be considered exposed?

Redis versions before 8.8.0 should be considered affected if authenticated users can execute RESTORE. The provided information does not state whether RESTORE is available in a default configuration.

How can I determine whether an instance is at risk?

Identify Redis instances running a version earlier than 8.8.0, then review which authenticated users or application identities can execute RESTORE. Instances meeting both conditions are exposed to this attack path.

REDHAT-BUG-2506985: Double Free

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Which deployments should be considered exposed?

How can I determine whether an instance is at risk?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which deployments should be considered exposed?

How can I determine whether an instance is at risk?