7.7
High
CVE-2026-23479 Redis is an in-memory data structure store
Description
Redis is an in-memory data structure store. In redis-server from 7.2.0 until 8.6.3, the unblock client flow does not handle an error return from `processCommandAndResetClient` when re-executing a blocked command. If a blocked client is evicted during this flow, an authenticated attacker can trigger a use-after-free that may lead to remote code execution. This has been patched in version 8.6.3.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Redis 7.2 | 7.2.0 → < 8.6.3 | 8.6.3 |
| Red Hat Enterprise Linux AppStream EUS (v. 10.0) | Versions not published | |
| Red Hat Enterprise Linux AppStream (v. 10) | Versions not published | |
| Red Hat Enterprise Linux AppStream EUS (v.9.6) | Versions not published | |
| Red Hat Enterprise Linux AppStream (v. 9) | Versions not published | |
| Red Hat Hardened Images 1.90 | earliest → < 1.90.0-7.hum1 | 1.90.0-7.hum1 |
| Red Hat Enterprise Linux 8 | Versions not published | |
| Red Hat Enterprise Linux 9 | Versions not published | |
| Red Hat Enterprise Linux 10 | Versions not published |
Show the 2 other branches Hide the 2 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Enterprise Linux 10.0 Extended Update Support | Versions not published | |
| Red Hat Enterprise Linux 9.6 Extended Update Support 9060020260602115714.9 | earliest → < 9060020260602115714.9 | 9060020260602115714.9 |
Other CVEs of Redis
The 50 CVEs of Redis →
CVE-2026-81934
Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS…
7.1
High
CVE-2026-72568
An out-of-bounds read vulnerability in Redis through 8.8.1 allows an adjacent unauthenticated attacker to cause denial…
7.1
High
CVE-2026-66373
Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code…
7.5
High
CVE-2026-25243
Redis is an in-memory data structure store
7.7
High