Skip to content
fr Sign in
6.1 Medium

CVE-2026-23631 Redis is an in-memory data structure store

Description

Redis is an in-memory data structure store. In all versions of redis-server with Lua scripting, an authenticated attacker can exploit the master-replica synchronization mechanism to trigger a use-after-free on replicas where replica-read-only is disabled or can be disabled, which may lead to remote code execution. A workaround is to prevent users from executing Lua scripts or avoid using replicas where replica-read-only is disabled. This is patched in version 8.6.3.

Affected products and versions

Product Affected versions Fixed in
Redis 8.6 earliest → < 8.6.3 8.6.3
Red Hat Enterprise Linux AppStream EUS (v. 10.0) Versions not published
Red Hat Enterprise Linux AppStream (v. 10) Versions not published
Red Hat Enterprise Linux AppStream EUS (v.9.6) Versions not published
Red Hat Enterprise Linux AppStream (v. 9) Versions not published
Red Hat Hardened Images Versions not published
Red Hat Enterprise Linux 8 Versions not published
Red Hat Enterprise Linux 9 Versions not published
Red Hat Enterprise Linux AppStream E4S (v.9.4) Versions not published
Show the 4 other branches
Product Affected versions Fixed in
Red Hat Enterprise Linux 10 Versions not published
Red Hat Enterprise Linux 10.0 Extended Update Support Versions not published
Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 9040020260625094332.9 earliest → < 9040020260625094332.9 9040020260625094332.9
Red Hat Enterprise Linux 9.6 Extended Update Support 9060020260602115714.9 earliest → < 9060020260602115714.9 9060020260602115714.9

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Redis

The 50 CVEs of Redis →
CVE-2026-81934 Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS… 7.1 High CVE-2026-72568 An out-of-bounds read vulnerability in Redis through 8.8.1 allows an adjacent unauthenticated attacker to cause denial… 7.1 High CVE-2026-66373 Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code… 7.5 High CVE-2026-25243 Redis is an in-memory data structure store 7.7 High
Track this CVE