On July 23, Redis released seven emergency security updates after researchers disclosed authenticated remote code execution (RCE) proofs of concept (PoCs) affecting multiple Redis versions including 6.2.22, 7.4.9, 8.6.4, and 8.8.0. These vulnerabilities primarily involve memory flaws that could potentially lead to unauthorized code execution. The security patches address several critical issues, including a shared-NACK use-after-free vulnerability in Redis Streams and out-of-bounds writes in the RedisBloom and TDigest modules.
For Redis 6.2.23, 7.2.15, and 7.4.10, the updates fix the Streams issue, while Redis 8.2.8, 8.4.5, and 8.6.5 address both the Streams and RedisBloom problems. Additionally, Redis 8.8.1 offers fixes for RedisBloom and TDigest loaders, though the Streams flaw was already managed in Redis 8.8.0. Prior updates from May, such as Redis 6.2.22 and 7.4.9, failed to incorporate necessary safeguards, prompting this urgent release.
Organizations using affected Redis versions are advised to upgrade immediately to the latest patched versions. Until then, they should revoke RESTORE permissions from non-essential accounts and limit access from untrusted networks to mitigate risk.
The vulnerabilities involve complex exploitation paths. The Streams path allows a corrupt RDB object to cause a double-free scenario, potentially leading to arbitrary memory access. The RedisBloom issue involves the TDigest loader, which can miscalculate buffer sizes and trigger out-of-bounds writes. While there have been no confirmed in-the-wild exploits as of July 24, the threat remains significant.
These vulnerabilities were identified by AI-driven agents, as reported by Chaofan Shou and the Bera Buddies research group. Though the claim of discovering 19 zero-days in under two hours is self-reported, the issues have been independently corroborated by Redis's security team through their patch releases.