Redis RCE Exploit PoC Bypasses Recent Security Patches
Memory Corruption Vectors in Redis Streams and RedisBloom
Even an applied security patch does not invariably seal a legacy vulnerability. A newly published suite of proof-of-concept demonstrations has exposed remote code execution capabilities within Redis versions 6.2.22, 7.4.9, 8.6.4, 8.8.0, and 8.8.1. Notably, portions of this code bypass previously issued remediations for CVE-2026-25243 and CVE-2026-25589, both of which carry a CVSS 3.1 severity rating of 8.8.
In versions 6.2.22, 7.4.9, and 8.6.4, the attack exploits a double-free memory flaw during the processing of shared negative acknowledgments within Redis Streams consumer groups. This failure corrupts the process memory structure, enabling arbitrary command execution on the server. The published exploit functions successfully despite the prior mitigation for CVE-2026-25243.
For Redis 8.8.0, researchers leveraged a distinct memory overflow vulnerability within the TDigest structure of the built-in RedisBloom module. Furthermore, an additional exploit targets TopK structures in Redis 8.8.0 and 8.8.1, circumventing the incomplete patch for CVE-2026-25589. Following the partial clearing of pointers, the deletion routine continued accessing elements beyond the allocated memory boundaries.
Execution Prerequisites and PoC Reliability
To trigger the execution flow, an attacker requires authorization to issue EVAL, RESTORE, and XGROUP commands. Exploits targeting the 8.8 release branch additionally require an active RedisBloom module. Because these demonstrations depend heavily on specific memory layouts, the authors validated their code against pristine official containers void of external traffic or concurrent commands. Technical details and code samples can be analyzed within the Redis PoC exploit repository on GitHub.
During empirical testing, the exploits consistently executed designated commands across supported versions. Although the authors characterize the code as non-destructive, execution leaves residual system keys and corrupted memory artifacts within the database. Incorrect memory offsets on custom builds may also cause server instability or process crashes.
Testing Guidelines and Security Recommendations
The suite is released strictly for authorized security assessment and research purposes. The authors advise running these demonstrations on fresh, isolated instances, independently calculating memory offsets for unofficial builds, and refraining from persisting Redis 8.8.0 database state following TDigest exploitation.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
