CyberSec.Space Logo
Back to CVE Browser

CVE-2026-66373

HIGH
7.5
CVSS Severity Score
EPSS Score0.0000%
EPSS Percentile0.00th
Published2026-07-25
Last Modified2026-07-25
Data SourcesNVD

Vulnerability Description

Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer, because deleting both consumers via XGROUP DELCONSUMER leads to a double free. NOTE: this issue exists because of an incomplete fix for CVE-2026-25243.

Affected Platforms (CPE)

No CPE configurations currently published for this record.

References & Advisories

🔗 https://github.com/berabuddies/redis-poc
🔗 https://github.com/redis/redis/compare/8.6.4...8.8.0
🔗 https://github.com/redis/redis/pull/15081
🔗 https://news.ycombinator.com/item?id=49024938
🔗 https://x.com/Fried_rice/status/2080059356322918777

Related Vulnerabilities

CVE-2026-660535.9

Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift Python bindings. This issue affects Apache T...

CVE-2026-586628.7

Improper Validation of Specified Quantity in Input, Out-of-bounds Read vulnerability in Apache Thrift C++ bindings. This issue af...

CVE-2026-583898.7

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Rust bindings. This issue affects Apache Thri...

CVE-2026-580236.9

Out-of-bounds Read vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.24.0. Users are re...