Redis’s recovery path is the problem here. A login that can use RESTORE can push Redis into authenticated remote code execution, so patching the server is only half the story if broad restore rights remain in place.
Researchers published PoCs against stock Redis 6.2.22, 7.4.9, 8.6.4, and 8.8.0, and Redis shipped seven fixes the same day. The affected bugs split into two families: a Streams shared-NACK use-after-free, and out-of-bounds writes in the bundled RedisBloom and TDigest loaders. Fixed releases are 6.2.23, 7.2.15, 7.4.10, 8.2.8, 8.4.5, 8.6.5, and 8.8.1.
The practical risk is that RESTORE is a normal-looking permission with an unsafe blast radius. If application or admin accounts keep it, the exploit path can remain open wherever patching lags, especially on systems that use RedisBloom or TDigest.