Vulnerability · Published Jul 25, 2026 · Assigned by mitre
CVE-2026-66373
High 7.5
In plain English
A high-severity double free in Redis from Redis. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer, because deleting both consumers via XGROUP DELCONSUMER leads to a double free. NOTE: this issue exists because of an incomplete fix for CVE-2026-25243.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | redis | 6.2.24-1.module_el8.10.0+4271+7f8f19af | ALSA-2026:64823 |
| AlmaLinux:9 | redis | 6.2.24-1.el9_8 | ALSA-2026:64824 |
| AlmaLinux:8 | redis-devel | 6.2.24-1.module_el8.10.0+4271+7f8f19af | ALSA-2026:64823 |
| AlmaLinux:9 | redis-devel | 6.2.24-1.el9_8 | ALSA-2026:64824 |
| AlmaLinux:8 | redis-doc | 6.2.24-1.module_el8.10.0+4271+7f8f19af | ALSA-2026:64823 |
| AlmaLinux:9 | redis-doc | 6.2.24-1.el9_8 | ALSA-2026:64824 |
| AlmaLinux:10 | valkey | 8.0.11-1.el10_2 | ALSA-2026:64796 |
| AlmaLinux:9 | valkey | 8.0.10-1.el9_8 | ALSA-2026:64807 |
| AlmaLinux:10 | valkey-devel | 8.0.11-1.el10_2 | ALSA-2026:64796 |
| AlmaLinux:9 | valkey-devel | 8.0.10-1.el9_8 | ALSA-2026:64807 |
| Debian:12 | redis | 5:7.0.15-1~deb12u9 | DEBIAN-CVE-2026-66373 |
| Rocky Linux:8 | redis | 0:6.2.24-1.module+el8.10.0+40313+282db117 | RLSA-2026:64823 |
| Rocky Linux:9 | redis | 0:6.2.24-1.el9_8 | RLSA-2026:64824 |
| Rocky Linux:9 | redis | 0:7.2.16-1.module+el9.8.0+40315+e15874a8 | RLSA-2026:65120 |
| Rocky Linux:10 | valkey | 0:8.0.11-1.el10_2 | RLSA-2026:64796 |
| Rocky Linux:9 | valkey | 0:8.0.10-1.el9_8 | RLSA-2026:64807 |
| Ubuntu:24.04:LTS | redis | no fix listed | UBUNTU-CVE-2026-66373 |
| Ubuntu:26.04:LTS | redis | no fix listed | UBUNTU-CVE-2026-66373 |
| Ubuntu:26.10 | redis | no fix listed | UBUNTU-CVE-2026-66373 |
Affected products (as reported)
Weakness: CWE-415 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H