Redis Streams shared-NACK use-after-free memory corruption flaw
Vulnerability
Summary
Hide ▲
Show ▼
The Redis Streams shared-NACK use-after-free affects Redis branches fixed in 6.2.23, 7.2.15, 7.4.10, 8.2.8, 8.4.5, and 8.6.5, leaving older releases exposed to authenticated RESTORE abuse and possible RCE. Public proof-of-concept code shows a corrupt RDB object can make two consumers free the same pending-entry record twice, turning the memory corruption into system() execution. Redis had not reported in-the-wild exploitation as of July 24, 2026, but patched releases are available for the affected branches.
Timeline
-
24.07.2026 09:58 1 articles · 12h ago
Researchers publish authenticated RCE PoCs for Redis Streams and RedisBloom
Initial DisclosureResearchers published authenticated RCE proof-of-concepts for stock Redis 6.2.22, 7.4.9, 8.6.4, and 8.8.0, showing RESTORE-based exploit chains against a Redis Streams shared-NACK use-after-free/double-free path and a RedisBloom TDigest out-of-bounds write path that can be driven toward system() execution.
Show sources
- Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say — thehackernews.com — 24.07.2026 09:58
-
24.07.2026 09:58 2 articles · 12h ago
Redis ships security releases for Streams shared-NACK and RedisBloom TDigest flaws
Mitigation Patch UpdateRedis shipped seven security releases, including Redis 6.2.23, 7.2.15, 7.4.10, 8.2.8, 8.4.5, 8.6.5, and 8.8.1, to fix the Streams shared-NACK use-after-free and the RedisBloom and TDigest loader memory corruption flaws; the July release notes did not assign a CVE or CVSS score to either bug class.
Show sources
- Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say — thehackernews.com — 24.07.2026 09:58
- Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say — thehackernews.com — 24.07.2026 09:58
-
24.07.2026 09:58 1 articles · 12h ago
No in-the-wild exploitation appears for the Redis July findings
Detection Ioc UpdateAs of July 24, 2026, no in-the-wild exploitation was reported for the Redis Streams shared-NACK or TDigest findings, and no separate NVD record or CISA Known Exploited Vulnerabilities entry was identified for either July bug class.
Show sources
- Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say — thehackernews.com — 24.07.2026 09:58