https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 22:28:26 +0000 https://cve.radiocsirt.org/vuln/alsa-2026:64796 <p><strong>Affected:</strong> AlmaLinux:10: valkey, AlmaLinux:10: valkey-devel</p> <p>Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set. In order to achieve its outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log. Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth. Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave like a cache. You can use Valkey from most programming languages also.</p> <p>Security Fix(es):</p> <p>* redis: Redis: Remote Code Execution via specially crafted RESTORE payload (CVE-2026-66373) * valkey: Valkey: Remote code execution via use-after-free in stream deserialization (CVE-2026-63639) * valkey: Valkey: Remote code execution via TLS pending-data processing use-after-free (CVE-2026-56684)</p> <p>Bug Fix(es) and Enhancement(s):</p> <p>* [Tracker] Rebase valkey to 8.0.10 (JIRA:AlmaLinux-216776)</p> <p>For more details about the security issue(s), including the im…</p> <p><strong>Affected:</strong> AlmaLinux:10: valkey, AlmaLinux:10: valkey-devel</p> <p>Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set. In order to achieve its outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log. Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth. Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave like a cache. You can use Valkey from most programming languages also.</p> <p>Security Fix(es):</p> <p>* redis: Redis: Remote Code Execution via specially crafted RESTORE payload (CVE-2026-66373) * valkey: Valkey: Remote code execution via use-after-free in stream deserialization (CVE-2026-63639) * valkey: Valkey: Remote code execution via TLS pending-data processing use-after-free (CVE-2026-56684)</p> <p>Bug Fix(es) and Enhancement(s):</p> <p>* [Tracker] Rebase valkey to 8.0.10 (JIRA:AlmaLinux-216776)</p> <p>For more details about the security issue(s), including the im…</p> https://cve.radiocsirt.org/vuln/alsa-2026:64796 https://cve.radiocsirt.org/vuln/bdu:2026-10490 bdu:2026-10490 https://cve.radiocsirt.org/vuln/bdu:2026-10490 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1094 certfr-2026-avi-1094 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1094 https://cve.radiocsirt.org/vuln/euvd-2026-349185 EUVD-2026-349185 https://cve.radiocsirt.org/vuln/euvd-2026-349185 https://cve.radiocsirt.org/vuln/fkie_cve-2026-66373 <p>Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer, because deleting both consumers via XGROUP DELCONSUMER leads to a double free. NOTE: this issue exists because of an incomplete fix for CVE-2026-25243.</p> <p>Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer, because deleting both consumers via XGROUP DELCONSUMER leads to a double free. NOTE: this issue exists because of an incomplete fix for CVE-2026-25243.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-66373 https://cve.radiocsirt.org/vuln/ghsa-c964-568j-vxx7 <p>Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer, because deleting both consumers via XGROUP DELCONSUMER leads to a double free. NOTE: this issue exists because of an incomplete fix for CVE-2026-25243.</p> <p>Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer, because deleting both consumers via XGROUP DELCONSUMER leads to a double free. NOTE: this issue exists because of an incomplete fix for CVE-2026-25243.</p> https://cve.radiocsirt.org/vuln/ghsa-c964-568j-vxx7 https://cve.radiocsirt.org/vuln/msrc_cve-2026-66373 msrc_CVE-2026-66373 https://cve.radiocsirt.org/vuln/msrc_cve-2026-66373 https://cve.radiocsirt.org/vuln/oesa-2026-3298 <p><strong>Affected:</strong> openEuler:22.03-LTS-SP4: redis, openEuler:24.03-LTS-SP1: redis, openEuler:24.03-LTS-SP3: redis, openEuler:24.03-LTS-SP4: redis, openEuler:20.03-LTS-SP4: redis</p> <p>Redis is an advanced key-value store. It is often referred to as a dattructure server since keys can contain strings, hashes ,lists, sets anorted sets. Security Fix(es):</p> <p>Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer, because deleting both consumers via XGROUP DELCONSUMER leads to a double free. NOTE: this issue exists because of an incomplete fix for CVE-2026-25243.(CVE-2026-66373)</p> <p><strong>Affected:</strong> openEuler:22.03-LTS-SP4: redis, openEuler:24.03-LTS-SP1: redis, openEuler:24.03-LTS-SP3: redis, openEuler:24.03-LTS-SP4: redis, openEuler:20.03-LTS-SP4: redis</p> <p>Redis is an advanced key-value store. It is often referred to as a dattructure server since keys can contain strings, hashes ,lists, sets anorted sets. Security Fix(es):</p> <p>Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer, because deleting both consumers via XGROUP DELCONSUMER leads to a double free. NOTE: this issue exists because of an incomplete fix for CVE-2026-25243.(CVE-2026-66373)</p> https://cve.radiocsirt.org/vuln/oesa-2026-3298 https://cve.radiocsirt.org/vuln/rhsa-2026:43236 <p>redis: Redis: Remote Code Execution via specially crafted RESTORE payload</p> <p>redis: Redis: Remote Code Execution via specially crafted RESTORE payload</p> https://cve.radiocsirt.org/vuln/rhsa-2026:43236 https://cve.radiocsirt.org/vuln/rhsa-2026:64796 <p>valkey: Valkey: Remote code execution via TLS pending-data processing use-after-free valkey: Valkey: Remote code execution via use-after-free in stream deserialization redis: Redis: Remote Code Execution via specially crafted RESTORE payload</p> <p>valkey: Valkey: Remote code execution via TLS pending-data processing use-after-free valkey: Valkey: Remote code execution via use-after-free in stream deserialization redis: Redis: Remote Code Execution via specially crafted RESTORE payload</p> https://cve.radiocsirt.org/vuln/rhsa-2026:64796 https://cve.radiocsirt.org/vuln/rlsa-2026:64796 <p><strong>Affected:</strong> Rocky Linux:10: valkey</p> <p>Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set. In order to achieve its outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log. Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth. Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave like a cache. You can use Valkey from most programming languages also.</p> <p>Security Fix(es):</p> <p>* redis: Redis: Remote Code Execution via specially crafted RESTORE payload (CVE-2026-66373)</p> <p>* valkey: Valkey: Remote code execution via use-after-free in stream deserialization (CVE-2026-63639)</p> <p>* valkey: Valkey: Remote code execution via TLS pending-data processing use-after-free (CVE-2026-56684)</p> <p>Bug Fix(es) and Enhancement(s):</p> <p>* [Tracker] Rebase valkey to 8.0.10 (JIRA:Rocky Linux-216776)</p> <p>For more details about the security issue(s), including the impact, a…</p> <p><strong>Affected:</strong> Rocky Linux:10: valkey</p> <p>Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set. In order to achieve its outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log. Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth. Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave like a cache. You can use Valkey from most programming languages also.</p> <p>Security Fix(es):</p> <p>* redis: Redis: Remote Code Execution via specially crafted RESTORE payload (CVE-2026-66373)</p> <p>* valkey: Valkey: Remote code execution via use-after-free in stream deserialization (CVE-2026-63639)</p> <p>* valkey: Valkey: Remote code execution via TLS pending-data processing use-after-free (CVE-2026-56684)</p> <p>Bug Fix(es) and Enhancement(s):</p> <p>* [Tracker] Rebase valkey to 8.0.10 (JIRA:Rocky Linux-216776)</p> <p>For more details about the security issue(s), including the impact, a…</p> https://cve.radiocsirt.org/vuln/rlsa-2026:64796 https://cve.radiocsirt.org/vuln/suse-su-2026:3636-1 <p>Security update for redis7</p> <p>Security update for redis7</p> https://cve.radiocsirt.org/vuln/suse-su-2026:3636-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-66373 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: redis, Ubuntu:Pro:16.04:LTS: redis, Ubuntu:Pro:18.04:LTS: redis, Ubuntu:Pro:20.04:LTS: redis, Ubuntu:Pro:22.04:LTS: redis, Ubuntu:24.04:LTS: redis, Ubuntu:26.04:LTS: redis</p> <p>Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer, because deleting both consumers via XGROUP DELCONSUMER leads to a double free. NOTE: this issue exists because of an incomplete fix for CVE-2026-25243.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: redis, Ubuntu:Pro:16.04:LTS: redis, Ubuntu:Pro:18.04:LTS: redis, Ubuntu:Pro:20.04:LTS: redis, Ubuntu:Pro:22.04:LTS: redis, Ubuntu:24.04:LTS: redis, Ubuntu:26.04:LTS: redis</p> <p>Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer, because deleting both consumers via XGROUP DELCONSUMER leads to a double free. NOTE: this issue exists because of an incomplete fix for CVE-2026-25243.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-66373 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2599 <p>Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Redis ausnutzen, um beliebigen Programmcode auszuführen.</p> <p>Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Redis ausnutzen, um beliebigen Programmcode auszuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2599