Critical Remote Code Execution Vulnerability in Redis Package - Important Security Update
Summary
ALSA-2026:26008: Important: redis:6 security update. Affects redis versions < 6.2.22-1.module_el8.10.0+4197+3446deec. Fixed in 6.2.22-1.module_el8.10.0+4197+3446deec. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Redis is an advanced key-value store often referred to as a data-structure server. It supports various data types such as strings, hashes, lists, sets, and sorted sets, and operates primarily in-memory for performance. Redis can persist data to disk either periodically or by logging commands. This flexibility makes it a popular choice for developers, but it also introduces potential security risks if not properly managed.
Vulnerability Detail
The vulnerability identified as CVE-2026-25243 in Redis involves an invalid memory access during the RESTORE command, which could allow an attacker to execute arbitrary code remotely. This flaw arises from improper handling of input data, leading to potential exploitation by malicious users. The ramifications of this vulnerability could be severe, including unauthorized access to sensitive data or complete system compromise.
How To Fix
Minimum fixed version
6.2.22-1.module_el8.10.0+4197+3446deec
This is the first release that contains the fix.
sudo dnf update redisTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can restrict access to the Redis server by configuring firewall rules to limit connections to trusted IP addresses only. This will help minimize exposure until the package can be updated.
Conclusion
The Redis package has a critical vulnerability (CVE-2026-25243) that could allow remote code execution due to invalid memory access. It is crucial to update to the patched version to protect your systems. Implementing temporary workarounds can help mitigate risks until the update is applied.
See every vulnerability recorded for redis →
FAQ
CVE-2026-25243 is a security vulnerability in Redis that allows for remote code execution due to invalid memory access during the RESTORE command.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
The vulnerability could lead to unauthorized access, data breaches, or complete system compromise, making it critical to address promptly.
Yes, a patch is available in version 6.2.22-1.module_el8.10.0+4197+3446deec and later. Updating to this version will resolve the issue.
If immediate updates are not possible, implement firewall rules to restrict access to the Redis server to trusted IP addresses as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for redis.
