Find notable cyber news and cases, enriched with sources, timelines, and signals.

Redis Streams shared-NACK use-after-free memory corruption flaw

Vulnerability
First reported
Last updated
Happening score
H score 31
1 unique sources, 1 articles

Summary

Hide ▲

The Redis Streams shared-NACK use-after-free affects Redis branches fixed in 6.2.23, 7.2.15, 7.4.10, 8.2.8, 8.4.5, and 8.6.5, leaving older releases exposed to authenticated RESTORE abuse and possible RCE. Public proof-of-concept code shows a corrupt RDB object can make two consumers free the same pending-entry record twice, turning the memory corruption into system() execution. Redis had not reported in-the-wild exploitation as of July 24, 2026, but patched releases are available for the affected branches.

Timeline

  1. 24.07.2026 09:58 1 articles · 12h ago

    Researchers publish authenticated RCE PoCs for Redis Streams and RedisBloom

    Initial Disclosure

    Researchers published authenticated RCE proof-of-concepts for stock Redis 6.2.22, 7.4.9, 8.6.4, and 8.8.0, showing RESTORE-based exploit chains against a Redis Streams shared-NACK use-after-free/double-free path and a RedisBloom TDigest out-of-bounds write path that can be driven toward system() execution.

    Show sources
  2. 24.07.2026 09:58 2 articles · 12h ago

    Redis ships security releases for Streams shared-NACK and RedisBloom TDigest flaws

    Mitigation Patch Update

    Redis shipped seven security releases, including Redis 6.2.23, 7.2.15, 7.4.10, 8.2.8, 8.4.5, 8.6.5, and 8.8.1, to fix the Streams shared-NACK use-after-free and the RedisBloom and TDigest loader memory corruption flaws; the July release notes did not assign a CVE or CVSS score to either bug class.

    Show sources
  3. 24.07.2026 09:58 1 articles · 12h ago

    No in-the-wild exploitation appears for the Redis July findings

    Detection Ioc Update

    As of July 24, 2026, no in-the-wild exploitation was reported for the Redis Streams shared-NACK or TDigest findings, and no separate NVD record or CISA Known Exploited Vulnerabilities entry was identified for either July bug class.

    Show sources