Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
Redis may let attackers run code or crash
published 1 month ago
Summary
The Redis data store you use could be tricked into running malicious programs or stopping service altogether. This risk comes from specially crafted data and internal handling errors. Apply the latest Redis update as soon as possible to protect your system.
What to do
- Update rocky redis to version 0:7.2.16-1.module+el9.8.0+40315+e15874a8.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Rocky Linux:9 | rocky | redis |
< 0:7.2.16-1.module+el9.8.0+40315+e15874a8 Fix: upgrade to 0:7.2.16-1.module+el9.8.0+40315+e15874a8
|
Original advisory text
Important: redis:7 security update
Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, or by appending each command to a log.
Security Fix(es):
* redis: Redis: Remote Code Execution via specially crafted RESTORE payload (CVE-2026-66373)
* redis: Redis: Denial of Service via Out-of-Bounds Read in Cluster Bus (CVE-2026-72568)
* redis: Redis: Arbitrary code execution via TLS pending-data list use-after-free (CVE-2026-81934)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Security Fix(es):
* redis: Redis: Remote Code Execution via specially crafted RESTORE payload (CVE-2026-66373)
* redis: Redis: Denial of Service via Out-of-Bounds Read in Cluster Bus (CVE-2026-72568)
* redis: Redis: Arbitrary code execution via TLS pending-data list use-after-free (CVE-2026-81934)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://errata.rockylinux.org/RLSA-2026:65120 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2506985 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2513105 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2525226 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:65120 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Timeline
Published9 Sep 2026
Updated9 Sep 2026
First seen9 Sep 2026
Sources
RLSA-2026:65120 · OSV
Track software like this
Free during beta