Use-After-Free Vulnerability in Redis Server by Redis Labs
CVE-2026-23479

7.7HIGH

Key Information:

Vendor

Redis

Status
Redis
Vendor
CVE Published:
5 May 2026

What is CVE-2026-23479?

Redis, an in-memory data structure store, has a vulnerability in the unblock client flow within versions from 7.2.0 to 8.6.3. When re-executing a blocked command, the system fails to handle an error return, which may lead to a scenario where an authenticated attacker can exploit this flaw. If a blocked client gets evicted during this process, it triggers a use-after-free condition that can facilitate remote code execution. To mitigate this risk, users should upgrade to version 8.6.3 or higher, where this issue has been addressed.

Affected Version(s)

redis >= 7.2.0, < 8.6.3

References

https://github.com/redis/redis/security/advisories/GHSA-9...
x_refsource_CONFIRM
https://github.com/redis/redis/releases/tag/8.6.3
x_refsource_MISC

CVSS V4

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.