CVE-2026-25243: redis-server RESTORE invalid memory access may allow remote code execution
Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This is patched in version 8.6.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redis-serverto a version that resolves this vulnerability.Fixed in 8.6.3 - Compensating control
Restrict access to the Redis RESTORE command using ACL rules (only allow the RESTORE command for trusted accounts/clients).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25243?
CVE-2026-25243 is considered to have a high severity due to the potential for remote code execution.
How do I fix CVE-2026-25243?
To remediate CVE-2026-25243, upgrade Redis server to version 8.6.4 or later.
Who is affected by CVE-2026-25243?
CVE-2026-25243 affects all versions of Redis server up to and including 8.6.3.
What components of Redis are vulnerable in CVE-2026-25243?
The RESTORE command in Redis is specifically vulnerable in CVE-2026-25243 due to improper validation of serialized values.
Can CVE-2026-25243 be exploited remotely?
Yes, CVE-2026-25243 can be exploited by an authenticated attacker with permission to execute the RESTORE command.