CVE-2026-25243
High · 8.8CVSS
8.8
EPSS
3.7%
Published
May 5, 2026
CISA due date
—
The record
Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This is patched in version 8.6.3.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | redis | 0 | 8.6.3-1.1 |
| openSUSE:Tumbleweed | valkey | 0 | 9.0.4-1.1 |
Related vulnerabilities
- CVE-2026-23631 Redis is an in-memory data structure store. Also affects redis
- CVE-2026-25589 RedisBloom is a probabilistic data structures module for Redis. Also affects redis
- CVE-2026-25588 RedisTimeSeries is a time-series module for Redis. Also affects redis
- CVE-2026-23479 Redis is an in-memory data structure store. Also affects redis
- CVE-2025-62507 Redis: Bug in XACKDEL may lead to stack overflow and potential RCE Also affects redis
- CVE-2025-49844 Redis is an open source, in-memory database that persists on disk. Also affects redis
- CVE-2024-46981 Redis is an open source, in-memory database that persists on disk. Also affects redis
- CVE-2024-51741 Redis is an open source, in-memory database that persists on disk. Also affects redis