Redis released seven security updates on July 23 to address authenticated Remote Code Execution (RCE) vulnerabilities across multiple versions, including 6.2, 7.4, 8.6, and 8.8. These vulnerabilities primarily involve memory corruption flaws triggered by the RESTORE command, specifically a shared-NACK use-after-free in Redis Streams and an out-of-bounds write in the RedisBloom TDigest loader. While some of these versions were part of previous security updates, they lacked specific guards now included in the latest releases.
Security researchers have published Proof-of-Concept (PoC) scripts demonstrating how these flaws can be leveraged to achieve arbitrary memory access and system-level execution. Users are strongly advised to upgrade to the latest fixed branches and restrict access to the RESTORE command for untrusted accounts to mitigate potential risks. Notably, some of these flaws were reportedly discovered by AI-driven research agents, highlighting an accelerated discovery cycle for modern database vulnerabilities.
Top comments (0)