Key Takeaways
- Researchers published authenticated remote‑code‑execution (RCE) proof‑of‑concept (PoC) exploits affecting multiple recent Redis versions (6.2.22, 7.4.9, 8.6.4, 8.8.0).
- Both exploit chains require the RESTORE command; one additionally needs EVAL and XGROUP (Streams path), while the other needs EVAL and the bundled RedisBloom module (TDigest path).
- The vulnerabilities stem from a use‑after‑free in the Streams subsystem (shared‑NACK bug) and an out‑of‑bounds write in the RedisBloom TDigest RDB loader.
- Patches were released on July 23, 2026: Redis 6.2.23, 7.2.15, 7.4.10 fix the Streams issue; Redis 8.2.8, 8.4.5, 8.6.5 address both Streams and RedisBloom/TDigest flaws; Redis 8.8.1 fixes the RedisBloom/TDigest loaders (the Streams guard was already in 8.8.0).
- No CVE identifiers have been assigned yet for the newly disclosed bugs, and no in‑the‑wild exploitation was reported as of July 24, 2026.
- Until systems can be upgraded, administrators should revoke RESTORE from accounts that do not strictly require it and block untrusted network access to mitigate both attack paths.
Overview of the July 2026 Redis Security Advisory
On July 23, 2026, Redis issued seven security releases after researchers disclosed authenticated RCE PoCs targeting stock Redis versions 6.2.22, 7.4.9, 8.6.4, and 8.8.0. All four exploit chains share a common prerequisite: the ability to execute the RESTORE command. Depending on the chain, additional commands such as EVAL, XGROUP, or the presence of the RedisBloom module are required. Redis warns that the underlying memory‑corruption flaws could lead to arbitrary code execution if exploited.
Two Distinct Exploitation Paths Via RESTORE
The advisory outlines two independent routes to RCE, both initiated through a malicious RDB payload supplied to RESTORE.
-
Streams Shared‑NACK Path – abuses a use‑after‑free condition in the Streams subsystem where a malformed RDB object can cause two consumer entries to reference the same pending‑entry record (streamNACK). Removing both consumers results in a double‑free, which the PoC transforms into arbitrary memory access and eventually invokes
system(). - RedisBloom TDigest Path – leverages an out‑of‑bounds write in the TDigest RDB loader within the RedisBloom module. The loader allocates memory based on a serialized compression value but then trusts an attacker‑controlled capacity field to decide how much data to copy, producing a write beyond the allocated buffer. The PoC converts this mismatch into read/write primitives, leaks addresses, and ultimately hijacks a hash function to call
system()via a crafted GET request.
The Streams Shared‑NACK Chain in Detail
The core of the Streams bug lies in the handling of pending‑entry records during consumer removal. A corrupted RDB file can set up a scenario where two distinct consumers point to the same streamNACK structure. When the first consumer is removed, the streamNACK is freed, leaving the second consumer with a dangling pointer. A subsequent removal of the second consumer triggers a double‑free of the same memory chunk. The published exploit for Redis 8.6.4 demonstrates how this double‑free can be turned into a write‑what‑where primitive, corrupting a hash function so that a later GET command executes attacker‑supplied code.
Notably, Redis 8.6.4’s release notes referenced PR #15081, which added a duplicate‑ownership guard. However, a source audit revealed that the tagged 8.6.4 source lacked this guard; it only appeared in the subsequent 8.6.5 release on July 23, confirming that the fix was missing from the initially shipped version.
The RedisBloom TDigest Chain Explained
In the RedisBloom module, the TDigest RDB loader reads a serialized compression value to allocate space for centroid arrays. It then reads a separate “capacity” field that indicates how many nodes should be loaded. If the capacity value exceeds the actual number of centroids that fit in the allocated buffer, the loader writes past the end of the allocation—an out‑of‑bounds write.
The exploit for Redis 8.8.0 shows how this overflow can be leveraged to gain read and write primitives, leak addresses from the Redis process and the underlying libc, and then poison a Redis hash function. A maliciously crafted GET key thereafter triggers system(), achieving remote code execution. The fix released in Redis 8.8.1 enforces that the loaded TDigest capacity must exactly match the allocation derived from the compression value and adds bounds checks on merged/unmerged node counters before accessing the arrays.
Patch Releases and Version Mapping
Redis addressed the flaws with a series of version bumps:
- Streams‑only fixes: Redis 6.2.23, 7.2.15, 7.4.10 (patch the shared‑NACK use‑after‑free).
- Combined Streams + RedisBloom/TDigest fixes: Redis 8.2.8, 8.4.5, 8.6.5 (address both the Streams issue and the out‑of‑bounds writes in RedisBloom and TDigest).
- RedisBloom/TDigest‑only fix: Redis 8.8.1 (corrects the TDigest loader; the Streams guard was already present in 8.8.0).
Users are urged to upgrade to the appropriate fixed release for their deployed branch. If immediate upgrading is not feasible, the advisory recommends revoking the RESTORE privilege from accounts that do not strictly need it and restricting network access to trusted clients, as removing RESTORE eliminates both disclosed attack vectors.
Absence of CVE Records and Public Exploitation Evidence
As of July 24, 2026, neither the Redis release notes nor the public PoC repositories referenced any CVE identifiers for the newly discovered Streams or TDigest bugs. Redis’s internal tracking links the Streams issue to an “incomplete fix family” under CVE‑2026‑25589, but that CVE is officially mapped to RedisBloom memory corruption during RESTORE, not the Streams shared‑NACK flaw. Consequently, no separate NVD entry exists for the July findings, and the vulnerability remains uncataloged in CISA’s Known Exploited Vulnerabilities list. No in‑the‑wild exploitation was reported at the time of the advisory.
Context: AI‑Assisted Discovery
The disclosure follows a trend of AI‑driven vulnerability research. A group calling itself “Bera Buddies” claimed to have used AI agents (specifically Kimi K3) to uncover 19 Redis zero‑days within roughly 90 minutes, with one run producing the Redis 8.8.0 exploit in just 27 minutes. While these claims are self‑reported and lack independent verification, Redis’s public acknowledgment confirms the authenticity of the flaws and the correctness of the released patches. The episode underscores the accelerating pace at which automated techniques can identify complex memory‑corruption issues in widely deployed software.
Practical Recommendations and Closing Thoughts
Organizations running Redis should immediately verify their version numbers against the fixed releases listed above. If running any of the vulnerable branches (6.2.22, 7.4.9, 8.6.4, or 8.8.0), upgrade to the corresponding patched version without delay. In environments where upgrading poses operational risk, apply the principle of least privilege: disable or restrict the RESTORE command for non‑essential users and enforce network segmentation to prevent untrusted clients from reaching the Redis port.
Although no active exploitation has been observed, the availability of reliable PoCs means that the window for attack is narrow but real. Prompt patching, combined with strict command‑level controls, remains the most effective defense against these newly disclosed Redis RCE vulnerabilities.