CyberRota Analysis
AI-GeneratedRedis versions prior to 8.8.0 are vulnerable to remote code execution due to a flaw in the RESTORE command, which can be exploited by authenticated attackers when multiple consumers reference the same NACK entry. The vulnerability arises from a double free condition triggered by the XGROUP DELCONSUMER command. Organizations using affected Redis versions should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer, because deleting both consumers via XGROUP DELCONSUMER leads to a double free. NOTE: this issue exists because of an incomplete fix for CVE-2026-25243.