7.5

CVE-2026-66373: redis Double Free

CVSS: 7.5v3.1HighAwaiting analysis
AliasesSUSE-SU-2026:3636-1SUSE-SU-2026:3637-1SUSE-SU-2026:3638-1
Published 25-07-2026Last modified 07-08-2026
Open JSON

Vulnerability summary

CVE-2026-66373 is a high (CVSS 7.5) Double Free vulnerability in redis. EPSS estimates a 0.87% chance of exploitation in the next 30 days, higher than 58.2% of scored vulnerabilities.

Overall risk
30/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
0.87%
0%100%
Low · +0.31 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 15
RHSA-2026:43236RHSA-2026:64796RHSA-2026:64807RHSA-2026:64823RHSA-2026:64824RHSA-2026:65120

Timeline

  1. 25-07-2026
    PublishedVulnerability first disclosed.
  2. 07-08-2026
    Last modifiedVulnerability information updated.

Description

Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer, because deleting both consumers via XGROUP DELCONSUMER leads to a double free. NOTE: this issue exists because of an incomplete fix for CVE-2026-25243.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.87%

Chance of exploitation in the next 30 days

Percentile

58%

Versus all other CVEs

30-day change

+0.31 pp

From 0.56% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.87%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Suse16 products
  • redis7&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS< 7.0.8-150500.3.34.1
  • redis7&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS< 7.0.8-150500.3.34.1
  • redis7&distro=SUSE Linux Enterprise Server 15 SP5-LTSS< 7.0.8-150500.3.34.1
  • redis7&distro=SUSE Linux Enterprise Server 15 SP6-LTSS< 7.0.8-150600.8.28.1
  • redis7&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP5< 7.0.8-150500.3.34.1
Debian1 product
  • redis< 5:7.0.15-1~deb12u9
Redis1 product
Ubuntu1 product
  • redisAll versions (No fix recorded)

4 vendors · 19 products

References

15 links
Show all 15 references