CVE-2026-25243

Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This is patched in version 8.6.3.

Redis is an advanced key-value store. It is often referred to as a dattructure server since keys can contain strings, hashes ,lists, sets anorted sets.

Security Fix(es):

When a blocked client is evicted while re-executing a blocked command, an authenticated user may trigger a use-after-free and potentially lead to remote code execution.

The problem exists in Redis 7.2 or newer.(CVE-2026-23479)

An authenticated user may exploit the synchronization mechanism of the master-replica and trigger a use-after-free vulnerability, potentially leading to remote code execution. The bug affects only replicas that are configured, or may be configured with replica-read-only disabled, and exists in all versions of Redis with Lua scripting.(CVE-2026-23631)

A vulnerability in the Redis RESTORE command allows an authenticated user to trigger an invalid memory access via a specially crafted serialized payload, potentially resulting in remote code execution. Successful exploitation could allow an attacker with authenticated access to execute arbitrary code in the context of the Redis server, potentially leading to full compromise of the affected system, data exfiltration, or service disruption. This problem affects all Redis versions.(CVE-2026-25243)

Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, or by appending each command to a log.

Security Fix(es):

• redis: RESTORE invalid memory access may allow remote code execution (CVE-2026-25243)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set. In order to achieve its outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log. Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth. Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave like a cache. You can use Valkey from most programming languages also.

Security Fix(es):

• redis: use-after-free in unblock client flow may allow remote code execution (CVE-2026-23479)

• redis: Remote code execution via use-after-free in Lua scripting (CVE-2026-23631)

• redis: RESTORE invalid memory access may allow remote code execution (CVE-2026-25243)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, or by appending each command to a log.

Security Fix(es):

• redis: use-after-free in unblock client flow may allow remote code execution (CVE-2026-23479)

• redis: Remote code execution via use-after-free in Lua scripting (CVE-2026-23631)

• redis: RESTORE invalid memory access may allow remote code execution (CVE-2026-25243)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set. In order to achieve its outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log. Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth. Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave like a cache. You can use Valkey from most programming languages also.

Security Fix(es):

• redis: use-after-free in unblock client flow may allow remote code execution (CVE-2026-23479)

• redis: Remote code execution via use-after-free in Lua scripting (CVE-2026-23631)

• redis: RESTORE invalid memory access may allow remote code execution (CVE-2026-25243)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, or by appending each command to a log.

Security Fix(es):

• redis: RESTORE invalid memory access may allow remote code execution (CVE-2026-25243)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This is patched in version 8.6.3.

Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, or by appending each command to a log.

Security Fix(es):

• redis: RESTORE invalid memory access may allow remote code execution (CVE-2026-25243)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set. In order to achieve its outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log. Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth. Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave like a cache. You can use Valkey from most programming languages also.

Security Fix(es):

• redis: use-after-free in unblock client flow may allow remote code execution (CVE-2026-23479)
• redis: Remote code execution via use-after-free in Lua scripting (CVE-2026-23631)
• redis: RESTORE invalid memory access may allow remote code execution (CVE-2026-25243)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, or by appending each command to a log.

Security Fix(es):

• redis: use-after-free in unblock client flow may allow remote code execution (CVE-2026-23479)
• redis: Remote code execution via use-after-free in Lua scripting (CVE-2026-23631)
• redis: RESTORE invalid memory access may allow remote code execution (CVE-2026-25243)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set. In order to achieve its outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log. Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth. Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave like a cache. You can use Valkey from most programming languages also.

Security Fix(es):

• redis: use-after-free in unblock client flow may allow remote code execution (CVE-2026-23479)
• redis: Remote code execution via use-after-free in Lua scripting (CVE-2026-23631)
• redis: RESTORE invalid memory access may allow remote code execution (CVE-2026-25243)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, or by appending each command to a log.

Security Fix(es):

• redis: RESTORE invalid memory access may allow remote code execution (CVE-2026-25243)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This is patched in version 8.6.3.

Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This is patched in version 8.6.3.

Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This is patched in version 8.6.3.

Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This is patched in version 8.6.3.

• CVE-2026-23631: use-after-free in readSyncBulkPayload when a full resync happens while a timed-out script is still running on the replica
• CVE-2026-25243: heap corruption and out-of-bounds reads in the RESTORE command deserialization path (rdb.c, sds.c, zipmap.c)

• CVE-2026-23631: fix use-after-free in readSyncBulkPayload when fullsync happens while a Lua script is timed out on the replica
• CVE-2026-25243: fix invalid memory access in RESTORE on crafted zipmap, listpack and stream PEL payloads

• SECURITY UPDATE: Memory exhaustion via unauthenticated client output buffer
  • debian/patches/0016-CVE-2025-21605.patch: cap the output buffer of unauthenticated clients in checkClientOutputBufferLimits() in src/networking.c, so a client that never reads its NOAUTH replies cannot grow the buffer without bound. Backport of upstream redis commit 5e93f9cb9 (6.2.18) as shipped by Debian for bullseye in 5:6.0.16-1+deb11u9 (DLA-4162-1), adapted to 5.0 by spelling the condition as server.requirepass && !c->authenticated, since 5.0 predates the ACL subsystem and has no authRequired() helper.
  • CVE-2025-21605
• SECURITY UPDATE: Client starvation via repeated accept() errors
  • debian/patches/0017-CVE-2025-48367.patch: add anetAcceptFailureNeedsRetry() to src/anet.c and retry the accept loop in acceptTcpHandler()/acceptUnixHandler() in src/networking.c and clusterAcceptHandler() in src/cluster.c, so a connection that fails at accept() time no longer aborts the whole batch and starves other pending clients. Backport of upstream redis commit 0fe674359 (6.2.19) as shipped by Debian for bullseye in 5:6.0.16-1+deb11u9 (DLA-4240-1); the acceptTLSHandler() hunk is dropped because 5.0 has no TLS support.
  • CVE-2025-48367
• SECURITY UPDATE: Double free via stream RDB payload with a shared NACK
  • debian/patches/0018-CVE-2026-66373.patch: reject a stream payload whose consumer PELs reference the same global-PEL NACK twice, in rdbLoadObject() in src/rdb.c, so RESTORE can no longer build two consumers sharing one streamNACK and have XGROUP DELCONSUMER free it twice. Backport of upstream redis commit 41a958720 (6.2.23) as shipped by Debian for bullseye and bookworm in 5:6.0.16-1+deb11u9 and 5:7.0.15-1~deb12u9 (DLA-4722-1), taken verbatim in the Debian form that uses rdbExitReportCorruptRDB(). Note this CVE exists because of an incomplete fix for CVE-2026-25243, which is a separate change and is not addressed here.
  • CVE-2026-66373

(CVE-2026-23479) Use-After-Free in unblock client flow may lead to Remote Code Execution. (CVE-2026-25243) Invalid memory access in RESTORE may lead to Remote Code Execution (CVE-2026-23631) Lua Use-After-Free may lead to remote code execution A user can manipulate data read by a connection by injecting \r\n sequences into a Redis error reply

These are all security issues fixed in the redis-8.6.3-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the valkey-9.0.4-1.1 package on the GA media of openSUSE Tumbleweed.

This update for valkey fixes the following issues

• CVE-2025-67733: data tampering and denial of service via improper null character handling in Lua scripts (bsc#1258746).
• CVE-2026-21863: denial of service via invalid clusterbus packet (bsc#1258788).
• CVE-2026-23479: use-after-free in unblock client flow may lead to remote code execution (bsc#1264164).
• CVE-2026-23631: Lua use-after-free via the master-replica synchronization mechanism may lead to remote code execution (bsc#1264165).
• CVE-2026-25243: invalid memory access in RESTORE command via a specially crafted serialized payload may lead to remote code execution (bsc#1264166).

Changes for valkey:

• Update to 8.0.9.

• Update to 8.0.7:

• Fix ltrim should not call signalModifiedKey when no elements are removed (#2787)
• Fix chained replica crash when doing dual channel replication (#2983)
• Fix used_memory_dataset underflow due to miscalculated used_memory_overhead (#3005)
• Avoids crash during MODULE UNLOAD when ACL rules reference a module command and subcommand (#3160)
• Fix server assert on ACL LOAD and resetchannels (#3182)
• Fix bug causing no response flush sometimes when IO threads are busy (#3205)

This update for redis fixes the following issues:

Changes in redis:

• Update to 8.10.1

  Update urgency: SECURITY: There are security fixes in the release.

  • Security fixes
    • (CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write
    • Out-of-bounds access in TopK heap cleanup path (MOD-15410)
    • Use-after-free in the TLS pending-data list when a command closes another pending connection
    • A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution
    • Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access
    • Vector Sets: use-after-free when VREM mutates the HNSW graph while background VSIM threads are still running
    • Vector Sets: a negative hnsw_search() return was treated as a huge unsigned count, reading past the end of the result arrays
    • TLS client certificate authentication bypass: a Common Name containing an embedded NUL byte was truncated, allowing a client to authenticate as another (possibly privileged) ACL user
    • #15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

• Restrict the "modules" flavour to x86_64 and aarch64 -- RedisBloom and RedisTimeSeries abort on anything else with "only supports 64-bit architectures (x64, arm64v8)", redisjson's vendored redis-module is 64-bit only, and modules/common.mk maps no other architecture at all

• Update to 8.10.0

  Major changes compared to 8.8

  • Compact hashes - a new hash encoding that reduces memory usage by storing hash field names just once for keys that share a schema
  • New command: HIMPORT - high-throughput compact hash bulk insertion
  • TLS peer certificate-based server-to-server authentication
  • New commands: LMOVEM, BLMOVEM - move multiple elements between lists
  • New command: SUNIONCARD - get the cardinality of the union of multiple sets
  • New command: SDIFFCARD - get the cardinality of the difference between sets
  • New command: BACKUP - node-side implementation for backup and restore based on multi-part AOF (MP-AOF)
  • XREAD, XREADGROUP - new MAXCOUNT and MAXSIZE arguments to cap the cumulative reply entries and size
  • New command: FT.ALIASLIST - get all aliases for the index
  • Stemmer support for Malay and Tagalog languages
  • JSONPath extensions
  • New commands: TS.NRANGE, TS.NREVRANGE - Query a range across multiple time series; group results by timestamp
  • New command: TS.READ - optionally blocking read
  • New command: TS.QUERYLABELS - Get a list of labels and label-values
  • New command: TS.MRANGE, TS.MREVRANGE - new EXCLUDEEMPTY argument to exclude series with no reported samples
  • Performance improvements

• Update to 8.8.1 Security fixes

  • RedisBloom/RedisBloom#1044 Crafted RESTORE payloads in RedisBloom and TDigest may trigger out-of-bounds writes, potentially leading to remote code execution

• Update to 8.8.0

  • New data structure: Array (@antirez)
  • Subkey notification for hash fields - field-level notifications
  • INCREX: a window counter rate limiter combining INCR, INCRBY, INCRBYFLOAT, bounds, and expiration (@raffertyyu + Redis team)
  • XNACK: a new streams command - allow consumers to explicitly release pending messages
  • ZUNION, ZINTER, ZUNIONSTORE, ZINTERSTORE: new COUNT aggregator
  • JSON.SET: new FPHA argument to specify the FP type for homogeneous FP arrays
  • TS.RANGE, TS.REVRANGE, TS.MRANGE, TS.MREVRANGE: multiple aggregators in a single command
  • FT.HYBRID KNN clause: new argument to request fewer candidates per shard
  • FT.PROFILE HYBRID: profiling support for FT.HYBRID
  • Performance improvements

• Updated to 8.6.3 (boo#1264164 boo#1264165 boo#1264166…

This update for valkey fixes the following issues

• CVE-2026-23479: use-after-free in unblock client flow may lead to remote code execution (bsc#1264164).
• CVE-2026-23631: Lua use-after-free via the master-replica synchronization mechanism may lead to remote code execution (bsc#1264165).
• CVE-2026-25243: invalid memory access in RESTORE command via a specially crafted serialized payload may lead to remote code execution (bsc#1264166).

Changes for valkey:

• Update to 8.0.9.

This update for valkey fixes the following issues

• CVE-2026-23479: use-after-free in unblock client flow may lead to remote code execution (bsc#1264164).
• CVE-2026-23631: Lua use-after-free via the master-replica synchronization mechanism may lead to remote code execution (bsc#1264165).
• CVE-2026-25243: invalid memory access in RESTORE command via a specially crafted serialized payload may lead to remote code execution (bsc#1264166).

Changes for valkey:

• Update to 8.0.9:

This update for redis7 fixes the following issues

• CVE-2026-23631: Lua use-after-free via the master-replica synchronization mechanism may lead to remote code execution (bsc#1264165).
• CVE-2026-25243: invalid memory access in RESTORE command via a specially crafted serialized payload may lead to remote code execution (bsc#1264166).

Other updates:

• an user can manipulate data read by a connection by injecting sequences into a Redis error reply (bsc#1258706).

This update for redis fixes the following issue

• CVE-2026-25243: invalid memory access in RESTORE command via a specially crafted serialized payload may lead to remote code execution (bsc#1264166).

This update for redis fixes the following issues

• CVE-2026-23479: use-after-free in unblock client flow may lead to remote code execution (bsc#1264164).
• CVE-2026-23631: Lua use-after-free via the master-replica synchronization mechanism may lead to remote code execution (bsc#1264165).
• CVE-2026-25243: invalid memory access in RESTORE command via a specially crafted serialized payload may lead to remote code execution (bsc#1264166).

This update for redis7 fixes the following issues

• CVE-2026-23631: Lua use-after-free via the master-replica synchronization mechanism may lead to remote code execution (bsc#1264165).
• CVE-2026-25243: invalid memory access in RESTORE command via a specially crafted serialized payload may lead to remote code execution (bsc#1264166).

This update for valkey fixes the following issues

• CVE-2025-67733: data tampering and denial of service via improper null character handling in Lua scripts (bsc#1258746).
• CVE-2026-21863: denial of service via invalid clusterbus packet (bsc#1258788).
• CVE-2026-23479: use-after-free in unblock client flow may lead to remote code execution (bsc#1264164).
• CVE-2026-23631: Lua use-after-free via the master-replica synchronization mechanism may lead to remote code execution (bsc#1264165).
• CVE-2026-25243: invalid memory access in RESTORE command via a specially crafted serialized payload may lead to remote code execution (bsc#1264166).

Changes for valkey:

• Update to 8.0.9.

• Update to 8.0.7:

• Fix ltrim should not call signalModifiedKey when no elements are removed (#2787)
• Fix chained replica crash when doing dual channel replication (#2983)
• Fix used_memory_dataset underflow due to miscalculated used_memory_overhead (#3005)
• Avoids crash during MODULE UNLOAD when ACL rules reference a module command and subcommand (#3160)
• Fix server assert on ACL LOAD and resetchannels (#3182)
• Fix bug causing no response flush sometimes when IO threads are busy (#3205)