PT-2026-37092 · Redis+2 · Redis-Server+3
CVSS v2.0
9.0
High
| Vector | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
redis-server versions prior to 8.6.3
Description
Redis is an in-memory data structure store. The
RESTORE command fails to properly validate serialized values. An authenticated attacker with permissions to execute this command can provide a crafted serialized payload, triggering invalid memory access which may lead to remote code execution.Recommendations
Update to version 8.6.3.
Restrict access to the
RESTORE command using ACL rules as a temporary workaround.Exploit
Fix
RCE
DoS
Heap Based Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Red Os
Redis
Rocky Linux
Redis-Server