UpHeron
All vulnerabilities

Servers and applications

CVE-2026-25243

Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL…

Severity
High 7.7
Published
5 May 2026
Last changed
25 Jul 2026
Added to UpHeron
21 Oct 2026
Fixed in
8.6.3
Sources
NVD

Affected software

SoftwareAffected versions
RedisServers and applications · cpe:a:redis:redis
  • Every version before 8.6.3

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-25243
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-25243