CVE-2026-25243

Description

Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This is patched in version 8.6.3.

How to fix CVE-2026-25243

To remediate CVE-2026-25243, upgrade the affected package to a fixed version below.

• —upgrade to 7.2.13-r0 or later
• —upgrade to 6.2.22 or later
• —upgrade to 6.2.22 or later
• —upgrade to 7.2.13 or later
• —no fix listed

Is CVE-2026-25243 being exploited?

Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.

Affected packages (5)

• from 0, < 7.2.13-r0
• from 0, < 6.2.22, >= 7.0.0, < 7.2.14, >= 7.3.0, < 7.4.9, >= 8.0.0, < 8.2.6, >= 8.3.0, < 8.4.3, >= 8.5.0, < 8.6.3
• from 0, < 6.2.22, >= 7.0.0, < 7.2.14, >= 7.3.0, < 7.4.9, >= 8.0.0, < 8.2.6, >= 8.3.0, < 8.4.3, >= 8.5.0, < 8.6.3
• from 0, < 7.2.13, >= 8.0.0, < 8.0.8, >= 8.1.0, < 8.1.7, >= 9.0.0, < 9.0.4
• from 0

CVSS scores

References (5)

• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2026-25243
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2026-25243
• WEBgithub.com/redis/redis/releases/tag/8.6.3
• WEBgithub.com/redis/redis/security/advisories/GHSA-c8h9-259x-jff4
• WEB