6.1
Moyenne
CVE-2026-23631 Redis is an in-memory data structure store
Description
Redis is an in-memory data structure store. In all versions of redis-server with Lua scripting, an authenticated attacker can exploit the master-replica synchronization mechanism to trigger a use-after-free on replicas where replica-read-only is disabled or can be disabled, which may lead to remote code execution. A workaround is to prevent users from executing Lua scripts or avoid using replicas where replica-read-only is disabled. This is patched in version 8.6.3.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Redis 8.6 | premières → < 8.6.3 | 8.6.3 |
| Red Hat Enterprise Linux AppStream EUS (v. 10.0) | Versions non publiées | |
| Red Hat Enterprise Linux AppStream (v. 10) | Versions non publiées | |
| Red Hat Enterprise Linux AppStream EUS (v.9.6) | Versions non publiées | |
| Red Hat Enterprise Linux AppStream (v. 9) | Versions non publiées | |
| Red Hat Hardened Images | Versions non publiées | |
| Red Hat Enterprise Linux 8 | Versions non publiées | |
| Red Hat Enterprise Linux 9 | Versions non publiées | |
| Red Hat Enterprise Linux AppStream E4S (v.9.4) | Versions non publiées |
Afficher les 4 autres branches Masquer les 4 autres branches
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Red Hat Enterprise Linux 10 | Versions non publiées | |
| Red Hat Enterprise Linux 10.0 Extended Update Support | Versions non publiées | |
| Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 9040020260625094332.9 | premières → < 9040020260625094332.9 | 9040020260625094332.9 |
| Red Hat Enterprise Linux 9.6 Extended Update Support 9060020260602115714.9 | premières → < 9060020260602115714.9 | 9060020260602115714.9 |
Références
- github.com github.com
- github.com github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Redis
Les 50 CVE de Redis →
CVE-2026-81934
Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS…
7.1
Élevée
CVE-2026-72568
An out-of-bounds read vulnerability in Redis through 8.8.1 allows an adjacent unauthenticated attacker to cause denial…
7.1
Élevée
CVE-2026-66373
Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code…
7.5
Élevée
CVE-2026-25243
Redis is an in-memory data structure store
7.7
Élevée