What’s Vulnerable › Vulnerabilities

CVE-2026-25243: redis-server RESTORE invalid memory access may allow remote code execution

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-05 · updated 2026-07-25
• Weakness: CWE-122

Description

Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This is patched in version 8.6.3.

Affected products

• Redis: before 8.6.3 — fixed in 8.6.3

How to fix

Upgrade to a fixed version: Redis 8.6.3. Check the vendor advisory for mitigations.

References

• https://github.com/redis/redis/releases/tag/8.6.3
• https://github.com/redis/redis/security/advisories/GHSA-c8h9-259x-jff4
• https://access.redhat.com/errata/RHSA-2026:14316
• https://access.redhat.com/errata/RHSA-2026:23229
• https://access.redhat.com/errata/RHSA-2026:25216
• https://access.redhat.com/errata/RHSA-2026:25219
• https://access.redhat.com/errata/RHSA-2026:25925
• https://access.redhat.com/errata/RHSA-2026:26008
• https://access.redhat.com/errata/RHSA-2026:26233
• https://access.redhat.com/errata/RHSA-2026:26306
• https://access.redhat.com/errata/RHSA-2026:26540
• https://access.redhat.com/errata/RHSA-2026:27716

Get alerted when CVE-2026-25243 or the next vulnerability affects your stack