CVE-2026-66373

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-25 · updated 2026-09-09
Weakness: CWE-415

Description

Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer, because deleting both consumers via XGROUP DELCONSUMER leads to a double free. NOTE: this issue exists because of an incomplete fix for CVE-2026-25243.

Affected products

Redis: before 8.8.0 — fixed in 8.8.0

How to fix

Upgrade to a fixed version: Redis 8.8.0. Check the vendor advisory for mitigations.

References

https://github.com/berabuddies/redis-poc
https://github.com/redis/redis/compare/8.6.4...8.8.0
https://github.com/redis/redis/pull/15081
https://news.ycombinator.com/item?id=49024938
https://x.com/Fried_rice/status/2080059356322918777
https://lists.debian.org/debian-lts-announce/2026/08/msg00012.html
https://github.com/berabuddies/redis-poc

Get alerted when CVE-2026-66373 or the next vulnerability affects your stack