Log in Start free

Vulnerability · Published May 5, 2026 · Assigned by GitHub_M

CVE-2026-23479redis-server use-after-free in unblock client flow may allow remote code execution

High 7.5

In plain English

A high-severity use-after-free in redis from redis. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.6% (higher than 85% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)2.6%top 14.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

Redis is an in-memory data structure store. In redis-server from 7.2.0 until 8.6.3, the unblock client flow does not handle an error return from `processCommandAndResetClient` when re-executing a blocked command. If a blocked client is evicted during this flow, an authenticated attacker can trigger a use-after-free that may lead to remote code execution. This has been patched in version 8.6.3.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:9redis7.2.14-1.module_el9.8.0+258+b8f945d3ALSA-2026:25219
AlmaLinux:9redis-devel7.2.14-1.module_el9.8.0+258+b8f945d3ALSA-2026:25219
AlmaLinux:9redis-doc7.2.14-1.module_el9.8.0+258+b8f945d3ALSA-2026:25219
AlmaLinux:10valkey8.0.9-1.el10_2ALSA-2026:25216
AlmaLinux:9valkey8.0.9-1.el9_8ALSA-2026:25925
AlmaLinux:10valkey-devel8.0.9-1.el10_2ALSA-2026:25216
AlmaLinux:9valkey-devel8.0.9-1.el9_8ALSA-2026:25925
Alpine:v3.20valkey7.2.13-r0ALPINE-CVE-2026-23479
Alpine:v3.21valkey7.2.13-r0ALPINE-CVE-2026-23479
Alpine:v3.22valkey8.1.7-r0ALPINE-CVE-2026-23479
Alpine:v3.23valkey9.0.4-r0ALPINE-CVE-2026-23479
Alpine:v3.24valkey9.0.4-r0ALPINE-CVE-2026-23479
Debian:14redictno fix listedDEBIAN-CVE-2026-23479
Debian:13redis5:8.0.2-3+deb13u3DEBIAN-CVE-2026-23479
Debian:14redis5:8.0.6-3DEBIAN-CVE-2026-23479
Debian:13valkey8.1.1+dfsg1-3+deb13u3DEBIAN-CVE-2026-23479
Debian:14valkey9.1.1-1DEBIAN-CVE-2026-23479
Rocky Linux:9redis0:7.2.14-1.module+el9.8.0+40207+e2014501RLSA-2026:25219
Rocky Linux:10valkey0:8.0.9-1.el10_2RLSA-2026:25216
Rocky Linux:9valkey0:8.0.9-1.el9_8RLSA-2026:25925
Ubuntu:24.04:LTSredisno fix listedUBUNTU-CVE-2026-23479
Ubuntu:25.10redisno fix listedUBUNTU-CVE-2026-23479
Ubuntu:26.04:LTSredisno fix listedUBUNTU-CVE-2026-23479
Ubuntu:26.10redisno fix listedUBUNTU-CVE-2026-23479

Affected products (as reported)

VendorProductVersions
redis redis >= 7.2.0, < 8.6.3

Weakness: CWE-416 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References