CVE-2026-23479
Redis is an in-memory data structure store. In redis-server from 7.2.0 until 8.6.3, the unblock client flow does not handle an error return from `processCommandAndResetClient` when re-executing a blocked command. If a blocked client is evicted during this flow, an authenticated attacker can trigger a use-after-free that may lead to remote code execution. This has been patched in version 8.6.3.
View on NVDAnalysis
Redis versions 7.2.0 through 8.6.2 are vulnerable to a remote code execution flaw triggered by an authenticated attacker during client unblocking flows. If you use Redis as a cache or message broker, you should upgrade to version 8.6.3 to mitigate the risk of server compromise via use-after-free exploitation.
Severity
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCWE-416EPSS
Affects
redis:redisTechnical description
Redis is an in-memory data structure store. In redis-server from 7.2.0 until 8.6.3, the unblock client flow does not handle an error return from `processCommandAndResetClient` when re-executing a blocked command. If a blocked client is evicted during this flow, an authenticated attacker can trigger a use-after-free that may lead to remote code execution. This has been patched in version 8.6.3.