CVE-2026-66373

Published Jul 25, 2026

Last updated 7 days ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-66373 describes a remote code execution vulnerability affecting Redis versions prior to 8.8.0. This flaw arises in specific circumstances where an authenticated attacker is able to execute the `RESTORE` command. The vulnerability is triggered by a double free condition. This occurs when a `RESTORE` payload references the same NACK (pending entry) through multiple consumers. Subsequently, deleting both consumers via `XGROUP DELCONSUMER` leads to the double free. This issue is noted as an incomplete fix for a previous vulnerability, CVE-2026-25243.

Description: Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer, because deleting both consumers via XGROUP DELCONSUMER leads to a double free. NOTE: this issue exists because of an incomplete fix for CVE-2026-25243.
Source: cve@mitre.org
NVD status: Received

Risk scores

CVSS 3.1

Type: Secondary
Base score: 7.5
Impact score: 5.9
Exploitability score: 1.6
Vector string: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

cve@mitre.org: CWE-415

Hype score: Not currently trending

References