Redis RCE PoC Published for 4 Major Versions
A working proof-of-concept (PoC) exploit has been published by security researchers that successfully demonstrates remote code execution (RCE) on four major Redis versions. The vulnerability, tracked as CVE-2026-25589, is described as part of an incomplete fix family exploiting a stream consumer-group shared-NACK double free bug.
The affected Redis versions include:
- Redis 6.2.22
- Redis 7.4.9
- Redis 8.6.4
TDigest Heap Overflow in Redis 8.8.0 via RedisBloom Module
In addition to the CVE-2026-25589 vulnerability, researchers also discovered a new TDigest heap overflow issue present in Redis version 8.8.0. This bug is specific to the bundled RedisBloom module.
The TDigest data structure, which stands for 'Tumbling Doubles Exponential Double Accumulator,' is used by RedisBloom for various statistical purposes, such as calculating quantiles or percentiles of datasets. The heap overflow vulnerability could potentially lead to arbitrary code execution if exploited.
GitHub Repository Gains Popularity
The GitHub repository containing the PoC exploit codes and detailed information about these vulnerabilities has gained significant attention within the security community. Within just 12 hours since its publication, the repository received over 195 stars from users worldwide.
Analysis of Vulnerabilities
The CVE-2026-25589 vulnerability targets a stream consumer-group shared-NACK double free issue in Redis versions 6.2.22, 7.4.9, and 8.6.4. This type of bug occurs when an application mistakenly frees the memory allocated for two different objects or variables that are supposed to be distinct but are actually pointing to the same location.
The shared-NACK mechanism in Redis streams allows multiple consumer groups to acknowledge receiving messages from a specific stream. When this process is compromised, it can lead to unintended consequences such as double-freeing the memory allocated for those objects, resulting in potential RCE scenarios.
On the other hand, the TDigest heap overflow vulnerability in Redis 8.8.0's RedisBloom module stems from improper handling of memory allocation within the TDigest data structure itself. This issue could allow attackers to manipulate the application's memory and execute arbitrary code if successfully exploited.
Implications for Founders
The publication of these vulnerabilities poses significant challenges for founders and organizations relying on Redis as their primary key-value database solution. As the PoC exploits demonstrate, both CVE-2026-25589 and the TDigest heap overflow can lead to severe consequences such as unauthorized access to systems or data breaches.
Founders must prioritize addressing these vulnerabilities by updating their Redis installations to patched versions that mitigate the risks associated with these bugs. Furthermore, they should consider implementing additional security measures like network segmentation, monitoring tools for detecting suspicious activities, and conducting regular vulnerability assessments to identify potential weaknesses in their infrastructure.
Conclusion
The discovery of CVE-2026-25589 and the TDigest heap overflow vulnerabilities in Redis highlights the importance of maintaining up-to-date software dependencies and staying informed about emerging threats within the cybersecurity landscape. Founders must remain vigilant in addressing such issues promptly to safeguard their businesses from potential attacks.