CVE-2026-66373

Executive Summary

CVE-2026-66373 is a double-free vulnerability in Redis versions before 8.8.0 that enables remote code execution. It affects Redis deployments where an authenticated attacker can issue the RESTORE command. An incomplete fix for CVE-2026-25243 allows a crafted RESTORE payload referencing the same NACK entry from multiple consumers; subsequent XGROUP DELCONSUMER operations on both consumers trigger the double free. The resulting memory corruption yields arbitrary code execution with CVSS 7.5 (High).

Technical Analysis

The flaw resides in Redis stream consumer-group handling during RESTORE deserialization. When a RESTORE payload encodes a pending entry (NACK) referenced by more than one consumer, the internal reference count is not properly incremented. Execution of XGROUP DELCONSUMER on each consumer decrements the count twice, producing a double free of the NACK structure. This occurs because the fix for CVE-2026-25243 only addressed single-consumer cases and left the multi-consumer reference path unprotected. Attack surface is limited to authenticated clients with RESTORE privileges, typically on internal or exposed Redis instances (port 6379/TCP). The double-free primitive allows heap shaping for control-flow hijacking, leading to RCE.

Exploitation Scenarios

1. Reconnaissance identifies exposed Redis instances via Shodan dorks for product:Redis on port 6379 and confirms version < 8.8.0 through INFO command. 2) Attacker authenticates and crafts a RESTORE payload containing a stream with one NACK entry referenced by two consumer groups. 3) The payload is sent via the RESTORE command; attacker then issues XGROUP DELCONSUMER on both consumers to trigger the double free and corrupt heap metadata. 4) Post-exploitation uses the resulting write-what-where primitive to overwrite function pointers or ROP chain into shell command execution, achieving code execution on the Redis host.

Impact Assessment

Successful exploitation grants full host compromise on affected Redis servers, including data exfiltration, lateral movement, and persistence. CVSS subscores reflect network attack vector, high complexity due to authentication and heap grooming, and complete impact on confidentiality, integrity, and availability. Blast radius is high in containerized or shared Redis deployments where one compromised instance can affect multiple services. No CISA KEV listing exists, and EPSS remains low at 0.00472.

Detection Guidance

Sigma Rule

title: Redis Double-Free via XGROUP DELCONSUMER
id: 3f8c2a1b-9e4d-4f2a-8c7b-1d5e6f7a8b9c
status: experimental
description: Detects sequences of RESTORE followed by multiple XGROUP DELCONSUMER on same stream
logsource:
  product: redis
detection:
  selection:
    command|contains:
      - 'RESTORE'
      - 'XGROUP DELCONSUMER'
  condition: selection
fields:
  - client_ip
  - command
level: high

YARA Rule

rule Redis_CVE_2026_66373_DoubleFree {
    meta:
        description = "Detects Redis stream NACK double-reference in RESTORE payloads"
    strings:
        $nack = { 4E 41 43 4B ?? ?? ?? ?? 02 00 }
        $restore = "RESTORE"
    condition:
        $restore and $nack
}

Suricata IDS Rule

alert tcp any any -> $REDIS_SERVERS 6379 (msg:"Redis CVE-2026-66373 RESTORE with multi-consumer NACK"; content:"RESTORE"; content:"XGROUP DELCONSUMER"; threshold:type limit, track by_src, seconds 60, count 3; sid:202666373; rev:1;)

Elastic Detection

sequence by process.pid with maxspan=30s
  [process where process.name == "redis-server" and command_line like "*RESTORE*"]
  [process where process.name == "redis-server" and command_line like "*XGROUP DELCONSUMER*"]

Splunk SPL Query

index=redis sourcetype=redis:command
| search command="*RESTORE*" OR command="*XGROUP DELCONSUMER*"
| transaction client_ip command maxspan=30s
| where mvcount(command) > 2
| stats count by client_ip, command

Wazuh OSSEC Rule

<rule id="649858" level="12">
  <if_sid>100001</if_sid>
  <match>RESTORE.*XGROUP DELCONSUMER</match>
  <description>Redis CVE-2026-66373 exploitation attempt detected</description>
</rule>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)).

1. Immediate mitigations: Restrict RESTORE command via ACLs to trusted clients only; disable unnecessary stream consumer-group features. 2) Patch/upgrade steps: Upgrade to Redis 8.8.0 once independently verified; test in staging before production rollout. 3) Long-term hardening: Implement network segmentation for Redis instances, enable TLS, and enforce least-privilege ACLs on all commands.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-66373 https://osv.dev/vulnerability/CVE-2026-66373 https://github.com/redis/redis (commit history for 8.8.0) No known threat actor campaigns or in-the-wild exploitation recorded.