Loading story…
Redis maintainers released security updates across multiple supported branches to fix several vulnerabilities in the in-memory database, including flaws that could cause denial of service, unauthorized information access, TLS certificate authentication bypass, and possible remote code execution during RDB loading. The most serious issues affect RDB parsing and include CVE-2026-62356, which stems from an incorrectly calculated buffer size that can trigger a heap out-of-bounds write, and another out-of-bounds slot ID flaw that could also enable injected code execution through memory corruption. Fixed versions include 8.10.1, 8.8.2, 8.6.6, 8.4.6, 8.2.9, 7.4.11, 7.2.16, and 6.2.24, and administrators were urged to update quickly.
Related hardening work in the Redis ecosystem shows additional scrutiny of corrupted RDB and RESTORE data handling. A published patch in the Valkey codebase rejects malformed stream consumer-group Pending Entries List data when a shared NACK appears across different consumers, treating the payload as a corrupt RDB and failing the load operation with a bad-format error. The fix adds validation and regression testing for crafted dump payloads, reinforcing concerns that malformed persistence data can be abused to crash services or potentially reach memory-corruption paths during database import and restore operations.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
A code commit added validation in RDB/RESTORE handling to reject corrupted stream consumer group data where a NACK is shared across different consumers, and included a regression test that verifies RESTORE fails on the malformed payload.
In July, an IT researcher reportedly found a total of 19 zero-day vulnerabilities in Redis using the Chinese AI system Kimi K3. The findings prompted Redis developers to prepare updated software packages.
Redis developers released updated versions 8.10.1, 8.8.2, 8.6.6, 8.4.6, 8.2.9, 7.4.11, 7.2.16, and 6.2.24 to fix multiple flaws affecting RDB loading, TLS certificate authentication, denial of service, and unauthorized information disclosure. One disclosed issue was CVE-2026-62356, a heap out-of-bounds write caused by an incorrectly calculated buffer size when loading RDB files.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Redis disclosed five vulnerabilities affecting Redis Cloud, Redis Software, and Redis OSS/CE that could allow authenticated attackers to achieve **remote code execution**, system compromise, data exfiltration, or service disruption. The issues tracked as `CVE-2026-23479`, `CVE-2026-25243`, `CVE-2026-25588`, `CVE-2026-25589`, and `CVE-2026-23631` include an invalid memory access flaw in the `RESTORE` command, a use-after-free bug in the unblock client flow, and a Lua use-after-free condition in certain replica configurations. Public advisories and downstream alerts described four of the bugs as high severity and one as medium severity, with multiple flaws capable of leading to arbitrary code execution. Redis said **Redis Cloud** deployments had already been patched and required no customer action, while self-managed users were told to upgrade to fixed releases across Redis OSS/CE, Redis Software, RedisTimeSeries, and RedisBloom. Government and national CERT notices echoed the vendor guidance and urged administrators to review the advisories and apply updates promptly. Redis also said it had **no evidence of active exploitation** at publication time, but recommended immediate patching and hardening measures such as restricting network exposure, enforcing strong authentication, keeping protected mode enabled where appropriate, and applying least-privilege access controls.
Jun 29, 2026
Researchers disclosed multiple authenticated remote code execution paths in Redis, showing how users with valid Redis credentials could potentially escalate from datastore access to host-level shell access on stock builds including Redis `6.2.22`, `7.4.9`, `8.6.4`, and `8.8.0`. The reported issues include a stream consumer-group shared-`NACK` double-free linked to the `CVE-2026-25589` incomplete-fix family and a heap overflow in the bundled RedisBloom `TDigest` module affecting Redis `8.8.0`. The attack chains rely on commonly enabled capabilities such as `EVAL`, `RESTORE`, and `XGROUP`, and the report said the double-free was only fully fixed in `8.8.0` while that same release still remained exposed to the RedisBloom bug at disclosure time. At the same time, new offensive-security tooling emerged to help identify exposed Redis deployments. A Rapid7 Metasploit pull request introduced an auxiliary scanner for `CVE-2025-49844` ("RediShell") that checks whether a Redis server is running an unpatched branch and whether Lua `EVAL` is reachable, highlighting how configuration choices such as ACLs can reduce practical exploitability even on vulnerable versions. The combined disclosures underscore the need to patch Redis promptly, restrict dangerous commands, keep Redis off the public internet, rotate credentials, review RedisBloom usage, and monitor for anomalous command activity that could indicate exploitation attempts.
Jul 24, 2026
Security advisories warned of two severe database software vulnerabilities with immediate internet-facing risk. In MongoDB, an unauthenticated network attacker can trigger an information disclosure flaw—described in some reporting as **MongoBleed**—to make a vulnerable server return sensitive data such as credentials, secrets, and personal information. The issue affects MongoDB releases dating back to about 2017 and stems from insufficient validation in the `zlib` implementation, which can leak uninitialized heap memory allocated to MongoDB. Working exploitation methods are known, and defenders were told to watch for large volumes of malformed or compressed requests, decompression or memory-handling errors, and repeated unauthenticated connections. Patches are available in versions `8.2.3`, `8.0.17`, `7.0.28`, `6.0.27`, `5.0.32`, and `4.4.30`, while end-of-life branches remain unpatched. A separate advisory disclosed a **critical Redis vulnerability** affecting `8.2.1` and earlier when Lua scripting is enabled, which is the default configuration. The flaw is a use-after-free condition that can be triggered by a specially crafted Lua script and may allow **remote arbitrary code execution**, giving an attacker full control of the host running Redis. Officials urged immediate upgrades because the vulnerability is publicly known and exploitation could begin within hours, and they advised organizations to inspect any previously exposed Redis environments for signs of compromise. Fixed versions were listed as `6.2.20`, `7.2.11`, `7.4.6`, `8.0.4`, and `8.2.2`, alongside renewed guidance that Redis instances should not be exposed directly to the public internet.
Jun 29, 2026