Redis Patches Zero-Day Vulnerabilities Allowing Remote Code Execution

Redis Addresses RCE Vulnerabilities

Redis issued seven security releases on July 23 to fix authenticated remote code execution (RCE) vulnerabilities. These vulnerabilities affect Redis versions 6.2.22, 7.4.9, 8.6.4, and 8.8.0. The fixes address underlying memory flaws that could lead to remote code execution.

Exploitation Requires RESTORE Command

All four RCE chains require the RESTORE command. Additionally, some chains need EVAL and XGROUP (for Streams), or EVAL and the bundled RedisBloom module (for 8.8.0). The vulnerabilities involve a shared-NACK use-after-free in Streams and out-of-bounds writes in RedisBloom and TDigest RDB loaders.

Patched Versions and Mitigation

Redis 6.2.23, 7.2.15, and 7.4.10 fix the Streams shared-NACK use-after-free. Redis 8.2.8, 8.4.5, and 8.6.5 fix both the Streams issue and the RedisBloom/TDigest out-of-bounds writes. Redis 8.8.1 addresses the RedisBloom and TDigest loaders. Users are advised to upgrade to the fixed release for their deployed branch. As a temporary measure, revoke RESTORE permissions from accounts that do not strictly need them and block untrusted network access, as this mitigates both disclosed paths.

No Active Exploitation Reported

As of July 24, 2026, neither Redis's release notes nor public proof-of-concept repositories have reported any in-the-wild exploitation of these vulnerabilities.