CVE-2026-23479
High · 8.8CVSS
8.8
EPSS
1.5%
Published
May 5, 2026
CISA due date
—
The record
Redis is an in-memory data structure store. In redis-server from 7.2.0 until 8.6.3, the unblock client flow does not handle an error return from `processCommandAndResetClient` when re-executing a blocked command. If a blocked client is evicted during this flow, an authenticated attacker can trigger a use-after-free that may lead to remote code execution. This has been patched in version 8.6.3.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | redis | 0 | 8.6.3-1.1 |
| openSUSE:Tumbleweed | valkey | 0 | 9.0.4-1.1 |
Related vulnerabilities
- CVE-2026-23631 Redis is an in-memory data structure store. Also affects redis
- CVE-2026-25243 Redis is an in-memory data structure store. Also affects redis
- CVE-2026-25589 RedisBloom is a probabilistic data structures module for Redis. Also affects redis
- CVE-2026-25588 RedisTimeSeries is a time-series module for Redis. Also affects redis
- CVE-2025-62507 Redis: Bug in XACKDEL may lead to stack overflow and potential RCE Also affects redis
- CVE-2025-49844 Redis is an open source, in-memory database that persists on disk. Also affects redis
- CVE-2024-46981 Redis is an open source, in-memory database that persists on disk. Also affects redis
- CVE-2024-51741 Redis is an open source, in-memory database that persists on disk. Also affects redis