Use-After-Free vulnerability affecting Redis
A vulnerability affecting Redis would allow an authenticated attacker to cause remote arbitrary code execution on affected systems.
Description
Technical context and vulnerability details
Redis is an open source in-memory data storage system, widely used as a database, cache, and message broker in modern application architectures. This tool is affected by a vulnerability labeled CVE-2026-23479, due to a lack of error checking in the client unblocking mechanism. Exploitation of this vulnerability would allow an authenticated attacker, by sending specially crafted commands to a Redis server, to execute arbitrary code on the host system. It is classified high with a severity score of 8.8 according to CVSS V3.1.
Potential Risks & Impact
Potential consequences upon exploitation
- Remote Arbitrary Code Execution;
- Total compromise of the host system;
- Disclosure of sensitive information;
- Damage to system integrity and availability;
Affected systems
Products, components and targeted versions
- Redis version 7.2.x, prior to 7.2.14;
- Redis version 7.4.x, earlier than 7.4.9;
- Redis version 8.2.x, prior to 8.2.6;
- Redis version 8.4.x, prior to 8.4.3;
- Redis version 8.6.x, prior to 8.6.3;
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Update Redis to the patched version corresponding to the branch used (7.2.14, 7.4.9, 8.2.6, 8.4.3 or 8.6.3);
Sources & External Links
Vendor security advisories and documentation
- https://redis.io/blog/security-advisory-cve202623479-cve202625243-cve-2026-25588-cve202625589-cve-2026-23631/
- https://www.cve.org/CVERecord?id=CVE-2026-23479
- https://nvd.nist.gov/vuln/detail/CVE-2026-23479
- https://github.com/redis/redis/releases
- https://thehackernews.com/2026/06/autonomous-ai-tool-finds-2-year-old-rce.html
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.