# CVE-2026-25243: redis: Redis is an in-memory data structure store

CVE-2026-25243 is fixed in 8 products on 1 platform, first by RHSA-2026:26540, released May 5, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-25243
- Priority: High
- CVSS: 8.8 (high)
- EPSS: 0.0403
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: May 5, 2026

## Description

Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This is patched in version 8.6.3.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | redis Debian 12.15 (bookworm) | 5:7.0.15-1~deb12u8 | [DEBIAN-CVE-2026-25243](https://patchblox.com/security/data/fix/linux/debian-cve-2026-25243.md) | May 5, 2026 |
| Linux | redis Debian 13.5 (trixie) | 5:8.0.2-3+deb13u3 | [DEBIAN-CVE-2026-25243](https://patchblox.com/security/data/fix/linux/debian-cve-2026-25243.md) | May 5, 2026 |
| Linux | redis Debian 14 | 5:8.0.6-3 | [DEBIAN-CVE-2026-25243](https://patchblox.com/security/data/fix/linux/debian-cve-2026-25243.md) | May 5, 2026 |
| Linux | redis RHEL 8 | 0:6.2.22-1.module+el8.10.0+24332+dbd3b426 | [RHSA-2026:26008](https://patchblox.com/security/data/fix/linux/rhsa-2026-26008.md) | Jun 24, 2026 |
| Linux | redis RHEL 9 | 0:7.2.14-1.module+el9.8.0+24327+41ceb644 | [RHSA-2026:25219](https://patchblox.com/security/data/fix/linux/rhsa-2026-25219.md) | Jun 24, 2026 |
| Linux | redis almalinux 8 | 6.2.22-1.module_el8.10.0+4197+3446deec | [ALSA-2026:26008](https://patchblox.com/security/data/fix/linux/alsa-2026-26008.md) | Jun 15, 2026 |
| Linux | redis almalinux 9 | 7.2.14-1.module_el9.8.0+258+b8f945d3 | [ALSA-2026:25219](https://patchblox.com/security/data/fix/linux/alsa-2026-25219.md) | Jun 11, 2026 |
| Linux | redis ol 8 | 0:6.2.22-1.0.1.module+el8.10.0+90916+da0c6127 | [ELSA-2026-26008](https://patchblox.com/security/data/fix/linux/elsa-2026-26008.md) | Jun 19, 2026 |
| Linux | redis ol 9 | 0:7.2.14-1.0.1.module+el9.8.0+90920+b17784e3 | [ELSA-2026-25219](https://patchblox.com/security/data/fix/linux/elsa-2026-25219.md) | Jun 23, 2026 |
| Linux | redis opensuse-leap 16.0 | 8.10.1-bp160.1.1 | [OPENSUSE-SU-2026:21612-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21612-1.md) | Aug 20, 2026 |
| Linux | redis rocky 8 | 0:6.2.22-1.module+el8.10.0+40211+0d1d5c90 | [RLSA-2026:26008](https://patchblox.com/security/data/fix/linux/rlsa-2026-26008.md) | Jun 17, 2026 |
| Linux | redis rocky 9 | 0:7.2.14-1.module+el9.8.0+40207+e2014501 | [RLSA-2026:25219](https://patchblox.com/security/data/fix/linux/rlsa-2026-25219.md) | Jun 13, 2026 |
| Linux | redis-devel RHEL 8 | 0:6.2.22-1.module+el8.10.0+24332+dbd3b426 | [RHSA-2026:26008](https://patchblox.com/security/data/fix/linux/rhsa-2026-26008.md) | Jun 24, 2026 |
| Linux | redis-devel RHEL 9 | 0:7.2.14-1.module+el9.8.0+24327+41ceb644 | [RHSA-2026:25219](https://patchblox.com/security/data/fix/linux/rhsa-2026-25219.md) | Jun 24, 2026 |
| Linux | redis-devel almalinux 8 | 6.2.22-1.module_el8.10.0+4197+3446deec | [ALSA-2026:26008](https://patchblox.com/security/data/fix/linux/alsa-2026-26008.md) | Jun 15, 2026 |
| Linux | redis-devel almalinux 9 | 7.2.14-1.module_el9.8.0+258+b8f945d3 | [ALSA-2026:25219](https://patchblox.com/security/data/fix/linux/alsa-2026-25219.md) | Jun 11, 2026 |
| Linux | redis-devel ol 8 | 0:6.2.22-1.0.1.module+el8.10.0+90916+da0c6127 | [ELSA-2026-26008](https://patchblox.com/security/data/fix/linux/elsa-2026-26008.md) | Jun 19, 2026 |
| Linux | redis-devel ol 9 | 0:7.2.14-1.0.1.module+el9.8.0+90920+b17784e3 | [ELSA-2026-25219](https://patchblox.com/security/data/fix/linux/elsa-2026-25219.md) | Jun 23, 2026 |
| Linux | redis-doc RHEL 8 | 0:6.2.22-1.module+el8.10.0+24332+dbd3b426 | [RHSA-2026:26008](https://patchblox.com/security/data/fix/linux/rhsa-2026-26008.md) | Jun 24, 2026 |
| Linux | redis-doc RHEL 9 | 0:7.2.14-1.module+el9.8.0+24327+41ceb644 | [RHSA-2026:25219](https://patchblox.com/security/data/fix/linux/rhsa-2026-25219.md) | Jun 24, 2026 |
| Linux | redis-doc almalinux 8 | 6.2.22-1.module_el8.10.0+4197+3446deec | [ALSA-2026:26008](https://patchblox.com/security/data/fix/linux/alsa-2026-26008.md) | Jun 15, 2026 |
| Linux | redis-doc almalinux 9 | 7.2.14-1.module_el9.8.0+258+b8f945d3 | [ALSA-2026:25219](https://patchblox.com/security/data/fix/linux/alsa-2026-25219.md) | Jun 11, 2026 |
| Linux | redis-doc ol 8 | 0:6.2.22-1.0.1.module+el8.10.0+90916+da0c6127 | [ELSA-2026-26008](https://patchblox.com/security/data/fix/linux/elsa-2026-26008.md) | Jun 19, 2026 |
| Linux | redis-doc ol 9 | 0:7.2.14-1.0.1.module+el9.8.0+90920+b17784e3 | [ELSA-2026-25219](https://patchblox.com/security/data/fix/linux/elsa-2026-25219.md) | Jun 23, 2026 |
| Linux | redis-modules opensuse-leap 16.0 | 8.10.1-bp160.1.1 | [OPENSUSE-SU-2026:21612-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21612-1.md) | Aug 20, 2026 |
| Linux | valkey Debian 13.5 (trixie) | 8.1.1+dfsg1-3+deb13u3 | [DEBIAN-CVE-2026-25243](https://patchblox.com/security/data/fix/linux/debian-cve-2026-25243.md) | May 5, 2026 |
| Linux | valkey Debian 14 | 9.1.1-1 | [DEBIAN-CVE-2026-25243](https://patchblox.com/security/data/fix/linux/debian-cve-2026-25243.md) | May 5, 2026 |
| Linux | valkey RHEL 10 | 8.0.9-1.el10_0 | [RHSA-2026:26540](https://patchblox.com/security/data/fix/linux/rhsa-2026-26540.md) | May 5, 2026 |
| Linux | valkey RHEL 9 | 0:8.0.9-1.el9_8 | [RHSA-2026:25925](https://patchblox.com/security/data/fix/linux/rhsa-2026-25925.md) | Jun 24, 2026 |
| Linux | valkey almalinux 10 | 8.0.9-1.el10_2 | [ALSA-2026:25216](https://patchblox.com/security/data/fix/linux/alsa-2026-25216.md) | Jun 11, 2026 |
| Linux | valkey almalinux 9 | 8.0.9-1.el9_8 | [ALSA-2026:25925](https://patchblox.com/security/data/fix/linux/alsa-2026-25925.md) | Jun 15, 2026 |
| Linux | valkey amzn 2023 | 9.0.4-1.amzn2023.0.1 | [ALAS2023-2026-1748](https://patchblox.com/security/data/fix/linux/alas2023-2026-1748.md) | May 25, 2026 |
| Linux | valkey ol 10 | 0:8.0.9-1.el10_2 | [ELSA-2026-25216](https://patchblox.com/security/data/fix/linux/elsa-2026-25216.md) | Jul 16, 2026 |
| Linux | valkey ol 9 | 0:8.0.9-1.el9_8 | [ELSA-2026-25925](https://patchblox.com/security/data/fix/linux/elsa-2026-25925.md) | Jun 24, 2026 |
| Linux | valkey rocky 10 | 0:8.0.9-1.el10_2 | [RLSA-2026:25216](https://patchblox.com/security/data/fix/linux/rlsa-2026-25216.md) | Jun 13, 2026 |
| Linux | valkey rocky 9 | 0:8.0.9-1.el9_8 | [RLSA-2026:25925](https://patchblox.com/security/data/fix/linux/rlsa-2026-25925.md) | Jun 17, 2026 |
| Linux | valkey-debuginfo amzn 2023 | 9.0.4-1.amzn2023.0.1 | [ALAS2023-2026-1748](https://patchblox.com/security/data/fix/linux/alas2023-2026-1748.md) | May 25, 2026 |
| Linux | valkey-debugsource amzn 2023 | 9.0.4-1.amzn2023.0.1 | [ALAS2023-2026-1748](https://patchblox.com/security/data/fix/linux/alas2023-2026-1748.md) | May 25, 2026 |
| Linux | valkey-devel RHEL 9 | 0:8.0.9-1.el9_8 | [RHSA-2026:25925](https://patchblox.com/security/data/fix/linux/rhsa-2026-25925.md) | Jun 24, 2026 |
| Linux | valkey-devel almalinux 10 | 8.0.9-1.el10_2 | [ALSA-2026:25216](https://patchblox.com/security/data/fix/linux/alsa-2026-25216.md) | Jun 11, 2026 |
| Linux | valkey-devel almalinux 9 | 8.0.9-1.el9_8 | [ALSA-2026:25925](https://patchblox.com/security/data/fix/linux/alsa-2026-25925.md) | Jun 15, 2026 |
| Linux | valkey-devel amzn 2023 | 9.0.4-1.amzn2023.0.1 | [ALAS2023-2026-1748](https://patchblox.com/security/data/fix/linux/alas2023-2026-1748.md) | May 25, 2026 |
| Linux | valkey-devel ol 10 | 0:8.0.9-1.el10_2 | [ELSA-2026-25216](https://patchblox.com/security/data/fix/linux/elsa-2026-25216.md) | Jul 16, 2026 |
| Linux | valkey-devel ol 9 | 0:8.0.9-1.el9_8 | [ELSA-2026-25925](https://patchblox.com/security/data/fix/linux/elsa-2026-25925.md) | Jun 24, 2026 |

---

Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.