Log in Start free

Vulnerability · Published May 5, 2026 · Assigned by GitHub_M

CVE-2026-23631redis-server Lua use-after-free may allow remote code execution

High 8.8

In plain English

A high-severity use-after-free in redis from redis. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.1% (higher than 88% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)3.1%top 12.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

Redis is an in-memory data structure store. In all versions of redis-server with Lua scripting, an authenticated attacker can exploit the master-replica synchronization mechanism to trigger a use-after-free on replicas where replica-read-only is disabled or can be disabled, which may lead to remote code execution. A workaround is to prevent users from executing Lua scripts or avoid using replicas where replica-read-only is disabled. This is patched in version 8.6.3.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:9redis7.2.14-1.module_el9.8.0+258+b8f945d3ALSA-2026:25219
AlmaLinux:9redis-devel7.2.14-1.module_el9.8.0+258+b8f945d3ALSA-2026:25219
AlmaLinux:9redis-doc7.2.14-1.module_el9.8.0+258+b8f945d3ALSA-2026:25219
AlmaLinux:10valkey8.0.9-1.el10_2ALSA-2026:25216
AlmaLinux:9valkey8.0.9-1.el9_8ALSA-2026:25925
AlmaLinux:10valkey-devel8.0.9-1.el10_2ALSA-2026:25216
AlmaLinux:9valkey-devel8.0.9-1.el9_8ALSA-2026:25925
Alpine:v3.20valkey7.2.13-r0ALPINE-CVE-2026-23631
Alpine:v3.21valkey7.2.13-r0ALPINE-CVE-2026-23631
Alpine:v3.22valkey8.1.7-r0ALPINE-CVE-2026-23631
Alpine:v3.23valkey9.0.4-r0ALPINE-CVE-2026-23631
Alpine:v3.24valkey9.0.4-r0ALPINE-CVE-2026-23631
Debian:14redictno fix listedDEBIAN-CVE-2026-23631
Debian:12redis5:7.0.15-1~deb12u8DEBIAN-CVE-2026-23631
Debian:13redis5:8.0.2-3+deb13u3DEBIAN-CVE-2026-23631
Debian:14redis5:8.0.6-3DEBIAN-CVE-2026-23631
Debian:13valkey8.1.1+dfsg1-3+deb13u3DEBIAN-CVE-2026-23631
Debian:14valkey9.1.1-1DEBIAN-CVE-2026-23631
Rocky Linux:9redis0:7.2.14-1.module+el9.8.0+40207+e2014501RLSA-2026:25219
Rocky Linux:10valkey0:8.0.9-1.el10_2RLSA-2026:25216
Rocky Linux:9valkey0:8.0.9-1.el9_8RLSA-2026:25925
Ubuntu:24.04:LTSredisno fix listedUBUNTU-CVE-2026-23631
Ubuntu:25.10redisno fix listedUBUNTU-CVE-2026-23631
Ubuntu:26.04:LTSredisno fix listedUBUNTU-CVE-2026-23631
Ubuntu:26.10redisno fix listedUBUNTU-CVE-2026-23631

Affected products (as reported)

VendorProductVersions
redis redis < 8.6.3

Weakness: CWE-416 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References