Critical Remote Code Execution Vulnerability in Redis Package
Summary
ALSA-2026:64824: Important: redis security, bug fix, and enhancement update. Affects redis versions < 6.2.24-1.el9_8. Fixed in 6.2.24-1.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Redis is an advanced key-value store often referred to as a data-structure server. It allows users to store various types of data structures, including strings, hashes, lists, sets, and sorted sets. Redis operates primarily in-memory for performance, with options for data persistence through periodic dumps or command logging. This makes it a popular choice for applications requiring fast data access. However, Redis is susceptible to security vulnerabilities, including remote code execution, which can compromise the integrity and security of applications relying on it.
Vulnerability Detail
The vulnerability in Redis arises from a remote code execution flaw via a specially crafted RESTORE payload (CVE-2026-66373) and an arbitrary code execution issue due to a TLS pending-data list use-after-free (CVE-2026-81934). These vulnerabilities can allow an attacker to execute arbitrary code on the server, potentially leading to unauthorized access, data breaches, or complete system compromise. The issues stem from improper handling of specific data structures and memory management, making it critical for users to address them promptly.
How To Fix
Minimum fixed version
6.2.24-1.el9_8
This is the first release that contains the fix.
sudo dnf update redisTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit access to the Redis server by configuring firewall rules to restrict incoming connections or by using a VPN to secure access. However, this is not a substitute for applying the necessary updates.
Conclusion
The Redis package has critical vulnerabilities that can lead to remote code execution and arbitrary code execution. It is essential for users to update to the latest patched version to secure their applications. Additionally, employing monitoring tools like Vulert can help in identifying and managing vulnerabilities in open-source software.
See every vulnerability recorded for redis →
FAQ
The vulnerabilities allow for remote code execution and arbitrary code execution due to improper handling of data structures and memory management.
You can check your Redis version using the command 'redis-server --version' and compare it to the patched version 6.2.24-1.el9_8.
Exploitation of these vulnerabilities can lead to unauthorized access, data breaches, and complete system compromise.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
More details can be found on the CVE pages for CVE-2026-66373 and CVE-2026-81934.
Related vulnerabilities
Recent vulnerabilities recorded for redis.
