Is CVE-2026-66373 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-66373?

CVE-2026-66373 has a CVSS v3 severity of HIGH (7.5).

Back

CVE-2026-66373

Description

Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer, because deleting both consumers via XGROUP DELCONSUMER leads to a double free. NOTE: this issue exists because of an incomplete fix for CVE-2026-25243.