CVE-2026-23631
High · 8.1CVSS
8.1
EPSS
2.8%
Published
May 5, 2026
CISA due date
—
The record
Redis is an in-memory data structure store. In all versions of redis-server with Lua scripting, an authenticated attacker can exploit the master-replica synchronization mechanism to trigger a use-after-free on replicas where replica-read-only is disabled or can be disabled, which may lead to remote code execution. A workaround is to prevent users from executing Lua scripts or avoid using replicas where replica-read-only is disabled. This is patched in version 8.6.3.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | redis | 0 | 8.6.3-1.1 |
| openSUSE:Tumbleweed | valkey | 0 | 9.0.4-1.1 |
Related vulnerabilities
- CVE-2026-25243 Redis is an in-memory data structure store. Also affects redis
- CVE-2026-25589 RedisBloom is a probabilistic data structures module for Redis. Also affects redis
- CVE-2026-25588 RedisTimeSeries is a time-series module for Redis. Also affects redis
- CVE-2026-23479 Redis is an in-memory data structure store. Also affects redis
- CVE-2025-62507 Redis: Bug in XACKDEL may lead to stack overflow and potential RCE Also affects redis
- CVE-2025-49844 Redis is an open source, in-memory database that persists on disk. Also affects redis
- CVE-2024-46981 Redis is an open source, in-memory database that persists on disk. Also affects redis
- CVE-2024-51741 Redis is an open source, in-memory database that persists on disk. Also affects redis