Researchers find Redis zero-days, build RCE exploits for 4 versions
This digest was compiled by AI from multiple sources — links to the originals are below.
Researchers published authenticated remote code execution proof-of-concept exploits for stock Redis 6.2.22, 7.4.9, 8.6.4, and 8.8.0 on July 23. Redis shipped seven security releases the same day to fix the underlying memory flaws. No in-the-wild exploitation has been reported as of July 24.
The Vulnerabilities
All four exploit chains require the RESTORE command. The Streams chains also need EVAL and XGROUP; the 8.8.0 chain additionally requires the bundled RedisBloom module. Redis stated that the memory flaws could lead to remote code execution. Two PoC targets, Redis 6.2.22 and 7.4.9, were the May security updates Redis told users to install, but those releases did not include the shared-NACK ownership guard.
Two Exploit Paths
The Redis Streams path exploits a shared-ownership bug: a corrupt RDB object can make two consumers point to the same pending-entry record, causing a double-free when both are removed. The RedisBloom path is an out-of-bounds write in the TDigest RDB loader, which allocates memory from one serialized value but trusts a separate attacker-controlled capacity field. Both chains are designed to escalate memory corruption to arbitrary code execution via system().
Patches and Mitigations
Redis 6.2.23, 7.2.15, and 7.4.10 fix the Streams shared-NACK use-after-free. Redis 8.2.8, 8.4.5, and 8.6.5 fix both the Streams issue and the RedisBloom and TDigest out-of-bounds writes. Redis 8.8.1 fixes the RedisBloom and TDigest loaders; the Streams guard was already present in 8.8.0. Until upgrades are applied, Redis recommends revoking RESTORE from accounts that do not strictly need it and blocking untrusted network access.
What's Next
Users are urged to upgrade to the fixed release for their deployed branch immediately. It remains unclear whether threat actors will incorporate these exploits into active campaigns, though no in-the-wild exploitation has been detected as of July 24.
1 source
Researchers find Redis zero-days, build RCE exploits for 4 versions
