CVE-2026-66373: Double Free
Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer, because deleting both consumers via XGROUP DELCONSUMER leads to a double free. NOTE: this issue exists because of an incomplete fix for CVE-2026-25243.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redisto a version that resolves this vulnerability.Fixed in 8.8.0 - Compensating control
Mitigate the issue by preventing authenticated users from executing the Redis RESTORE command (e.g., restrict command permissions/ACLs so RESTORE cannot be used by untrusted clients).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-66373?
CVE-2026-66373 has a severity score of 7.5, categorized as high.
How do I fix CVE-2026-66373?
To fix CVE-2026-66373, upgrade Redis to version 8.8.0 or later.
What impact does CVE-2026-66373 have?
CVE-2026-66373 allows remote code execution under specific conditions, posing a significant security risk.
Who is affected by CVE-2026-66373?
CVE-2026-66373 affects all authenticated users of Redis versions prior to 8.8.0.
What is the exploitability of CVE-2026-66373?
CVE-2026-66373 can be exploited by an authenticated attacker who can execute the RESTORE command.