CVE-2026-66373: Redis RCE Vulnerability

CVE-2026-66373 Overview

CVE-2026-66373 is a double free vulnerability [CWE-415] in Redis versions before 8.8.0. An authenticated attacker with permission to execute the RESTORE command can trigger remote code execution. The flaw occurs when a RESTORE payload references the same NACK (pending entry) from more than one consumer. Deleting both consumers via XGROUP DELCONSUMER then frees the same memory twice. This issue exists because of an incomplete fix for CVE-2026-25243. The vulnerability affects Redis deployments where the RESTORE command is accessible to authenticated users.

Critical Impact
Authenticated attackers with RESTORE command access can achieve remote code execution against Redis instances running versions before 8.8.0, compromising data confidentiality, integrity, and availability.

Affected Products

Redis versions before 8.8.0
Redis 8.6.4 and earlier 8.x releases
Redis deployments exposing the RESTORE command to authenticated users

Discovery Timeline

2026-07-25 - CVE-2026-66373 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-66373

Vulnerability Analysis

The vulnerability resides in Redis stream consumer group handling. Redis streams use NACK structures to track pending entries assigned to consumers. Each pending entry list (PEL) reference is expected to belong to a single consumer at a time. The RESTORE command deserializes a serialized value and inserts it into the keyspace. A crafted RESTORE payload can produce a stream state where the same NACK object is referenced by two different consumers within a consumer group.

When the attacker issues XGROUP DELCONSUMER to delete the first consumer, Redis frees the shared NACK. Deleting the second consumer frees the same NACK a second time. The resulting double free corrupts heap metadata and enables memory allocator manipulation. An attacker who controls subsequent allocations can steer execution flow and execute arbitrary code within the Redis process context.

Root Cause

The root cause is missing validation of NACK ownership during RESTORE deserialization. The prior fix for CVE-2026-25243 did not fully block cases where a serialized stream can encode duplicate consumer references to the same pending entry. The consumer teardown path frees the referenced NACK without checking whether other consumers still hold a reference, producing the double free classified under [CWE-415].

Attack Vector

Exploitation requires network access to Redis and authenticated privileges sufficient to execute RESTORE and stream administration commands. The attacker crafts a malicious serialized stream payload, calls RESTORE to import it, then invokes XGROUP DELCONSUMER twice against the two consumers referencing the shared NACK. The second deletion triggers the double free. Attack complexity is high because the attacker must groom the allocator to convert the double free into controlled execution. Technical details are available in the Redis pull request 15081, the version comparison between 8.6.4 and 8.8.0, and a proof-of-concept repository.

Detection Methods for CVE-2026-66373

Indicators of Compromise

Unexpected RESTORE commands executed against Redis instances, particularly from accounts that do not normally perform bulk data imports.
Consecutive XGROUP DELCONSUMER calls targeting the same consumer group shortly after a RESTORE operation.
Redis process crashes, segmentation faults, or abnormal restarts logged in redis-server.log following stream operations.

Detection Strategies

Enable Redis command logging or MONITOR sampling and alert on RESTORE invocations correlated with stream consumer deletion sequences.
Track Redis process integrity through host telemetry, including unexpected child processes spawned by redis-server.
Compare deployed Redis version strings against the fixed release 8.8.0 across the estate.

Monitoring Recommendations

Ingest Redis access logs and audit trails into a centralized analytics platform for correlation with authentication events.
Monitor outbound network connections from Redis hosts for post-exploitation callbacks.
Alert on modifications to Redis ACL definitions that grant RESTORE or stream administration privileges to previously restricted users.

How to Mitigate CVE-2026-66373

Immediate Actions Required

Upgrade Redis to version 8.8.0 or later on all affected instances.
Restrict the RESTORE command through Redis ACLs so only trusted administrative accounts can invoke it.
Audit existing ACL rules and remove stream administration permissions from application service accounts that do not require them.
Rotate credentials for any Redis account that had RESTORE privileges before patching.

Patch Information

The fix is included in Redis 8.8.0. Review the upstream commit series between 8.6.4 and 8.8.0 and pull request 15081 for the code change that validates NACK ownership during stream deserialization and consumer teardown.

Workarounds

Disable the RESTORE command via rename-command RESTORE "" in redis.conf where the command is not required.
Enforce network-level restrictions so Redis is not reachable from untrusted networks or workloads.
Require strong authentication and per-user ACLs; avoid shared administrative credentials.

bash

# Configuration example: restrict RESTORE via ACL and disable command where unused
# redis.conf
rename-command RESTORE ""

# Or via ACL, allow RESTORE only for a dedicated admin user
ACL SETUSER app_user on >STRONG_PASSWORD ~* +@read +@write -@dangerous -RESTORE
ACL SETUSER redis_admin on >ADMIN_PASSWORD ~* +@all