What is CVE-2026-66373?
CVE-2026-66373 affects Redis before version 8.8.0, allowing remote code execution via a RESTORE payload when an authenticated attacker can execute RESTORE. The vulnerability is due to a double free occurring when both consumers referencing the same NACK are deleted using XGROUP DELCONSUMER. Upgrading to Redis 8.8.0 or later is recommended.
Azərbaycanca: CVE-2026-66373 Redis-in 8.8.0-dən əvvəlki versiyalarında autentifikasiya olunmuş şəxsin RESTORE əmrini icra edə bildiyi nadir hallarda remote code execution-ə səbəb olur. Zəiflik XGROUP DELCONSUMER vasitəsilə hər iki consumer silindikdə yaranan double free problemi ilə bağlıdır. Redis-i 8.8.0 və ya daha yuxarı versiyaya yeniləmək tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-416
FAQ2
Which versions of Redis are affected by CVE-2026-66373?
This vulnerability affects Redis versions before 8.8.0.
What is the root cause of CVE-2026-66373?
The vulnerability is due to a double free issue occurring when both consumers referencing the same NACK are deleted using XGROUP DELCONSUMER.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.