CVE-2026-66373 Use after free in Redis
An authenticated attacker can achieve remote code execution in Redis by exploiting a double free vulnerability in the RESTORE command handling.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-66373?
CVE-2026-66373 is a high-severity use after free vulnerability in Redis, published on 25 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer, because deleting both consumers via XGROUP DELCONSUMER leads to a double free. NOTE: this issue exists because of an incomplete fix for CVE-2026-25243.
Weakness: CWE-415
Which versions are affected by CVE-2026-66373?
Linux distribution packages (16)
redis SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | All versions | 6.2.6-150400.3.49.1 |
redis SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | All versions | 6.2.6-150400.3.49.1 |
redis SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | All versions | 6.2.6-150400.3.49.1 |
redis7 SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | All versions | 7.0.8-150500.3.34.1 |
redis SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | All versions | 6.2.6-150400.3.49.1 |
redis7 SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | All versions | 7.0.8-150500.3.34.1 |
redis SUSE:Linux Enterprise Server 15 SP4-LTSS | All versions | 6.2.6-150400.3.49.1 |
redis SUSE:Linux Enterprise Server 15 SP5-LTSS | All versions | 6.2.6-150400.3.49.1 |
redis7 SUSE:Linux Enterprise Server 15 SP5-LTSS | All versions | 7.0.8-150500.3.34.1 |
redis SUSE:Linux Enterprise Server 15 SP6-LTSS | All versions | 7.2.4-150600.3.27.1 |
redis7 SUSE:Linux Enterprise Server 15 SP6-LTSS | All versions | 7.0.8-150600.8.28.1 |
redis SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | All versions | 6.2.6-150400.3.49.1 |
redis SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | All versions | 6.2.6-150400.3.49.1 |
redis7 SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | All versions | 7.0.8-150500.3.34.1 |
redis SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | All versions | 7.2.4-150600.3.27.1 |
redis7 SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | All versions | 7.0.8-150600.8.28.1 |
How do I fix CVE-2026-66373?
Upgrade to a fixed version.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-66373 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-66373 exists.
Sources
Also known as AZL-93408, CLSA-2026-1788963269, CLSA-2026-1789375350, DEBIAN-CVE-2026-66373, GHSA-c964-568j-vxx7, OESA-2026-3298 and 5 more.