releases.shpreview
RedisRedis/redis

Stream RESTORE use-after-free RCE patched

v7.2.15

July 23, 2026redisView original ↗
1 fixThis release1 fixBug fixesAI-tallied from the release notes
From the original release noteView original ↗

Update urgency: SECURITY: There is a security fix in the release.

Security fixes

  • A crafted stream RESTORE payload can make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution

Fetched July 23, 2026