CVE-2026-663737.5HighCWE-415
Redis vulnerability
Not in CISA KEVFixed in version 8.8.0
0.9%probability of exploitation in the next 30 days
58th percentile
050100
Higher than 58% of scored CVEs
7.5HighCVSS 3.1
LowMediumHighCrit.
DescriptionNVD
Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer, because deleting both consumers via XGROUP DELCONSUMER leads to a double free. NOTE: this issue exists because of an incomplete fix for CVE-2026-25243.
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 30 Jul.
- CVE-2026-66373: Redis RCE Proof-of-Concept Publicly DisclosedSecurityOnline · first in our coverage
New articles also arrive in the RSS feed.