Critical Redis Vulnerability: Remote Code Execution Risk in Redis Packages
Summary
ALSA-2026:23229: Important: redis security update. Affects redis versions < 6.2.22-1.el9_8. Fixed in 6.2.22-1.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Redis is an advanced key-value store often referred to as a data-structure server. It allows users to store various data types such as strings, hashes, lists, sets, and sorted sets. Redis operates primarily in-memory for performance, with options for data persistence through periodic dumps or command logging. This flexibility makes Redis a popular choice for applications requiring fast data access. However, it is crucial to maintain security, as vulnerabilities can lead to severe consequences, including unauthorized access and data manipulation.
Vulnerability Detail
The vulnerability identified as CVE-2026-25243 involves an invalid memory access in the RESTORE command of Redis. This flaw can potentially allow remote code execution, enabling attackers to execute arbitrary code on the server. The risk arises from improper handling of input data, which can lead to memory corruption. If exploited, this vulnerability could compromise the integrity and confidentiality of the data stored in Redis, making it critical for users to address this issue promptly.
How To Fix
Minimum fixed version
6.2.22-1.el9_8
This is the first release that contains the fix.
sudo dnf update redisTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the available patch as soon as possible.
Conclusion
The Redis vulnerability CVE-2026-25243 poses a significant risk due to its potential for remote code execution. Users are strongly encouraged to update their Redis packages to the patched version 6.2.22-1.el9_8 to mitigate this risk. Staying informed and proactive about security vulnerabilities is essential for maintaining the integrity of your applications.
See every vulnerability recorded for redis →
FAQ
CVE-2026-25243 is a vulnerability in Redis that allows for remote code execution due to invalid memory access in the RESTORE command.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. By uploading your manifest file, you can check if your application is affected.
Failure to address this vulnerability could lead to unauthorized access, data manipulation, and potential data breaches, compromising the security of your application.
While there are no specific workarounds, it is advisable to limit access to the Redis server and monitor for any unusual activity until the update can be applied.
For more details, refer to the CVE page associated with CVE-2026-25243, which provides in-depth information about the vulnerability and its impact.
Related vulnerabilities
Recent vulnerabilities recorded for redis.
