Skip to content
Fencer Vulns
high 7.5

CVE-2026-23479 json

redis-server use-after-free in unblock client flow may allow remote code execution

published 2026-05-05 6 mo ago modified 2026-09-08 2 mo ago also BIT-keydb-2026-23479 , BIT-redis-2026-23479 , BIT-valkey-2026-23479 , EUVD-2026-27396 , GHSA-93m2-935m-8rj3

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.6%
EPSS 2.6% chance of exploitation in 30 days, percentile 85%
public exploits
0
none known

Summary

Redis is an in-memory data structure store. In redis-server from 7.2.0 until 8.6.3, the unblock client flow does not handle an error return from `processCommandAndResetClient` when re-executing a blocked command. If a blocked client is evicted during this flow, an authenticated attacker can trigger a use-after-free that may lead to remote code execution. This has been patched in version 8.6.3.

Patch / fix

  • bitnami keydb 7.2.14, 7.4.9, 8.2.6, 8.4.3, 8.6.3
  • bitnami redis 7.2.14, 7.4.9, 8.2.6, 8.4.3, 8.6.3
  • bitnami valkey 7.2.13, 8.0.8, 8.1.7, 9.0.4
  • Red Hat Red Hat Enterprise Linux 10 0:8.0.9-1.el10_2
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support 0:8.0.9-1.el10_0
  • Red Hat Red Hat Enterprise Linux 9 0:8.0.9-1.el9_8, 9080020260521083756.9
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support 9060020260602115714.9
  • Red Hat Red Hat Hardened Images 1.90.0-7.hum1, 9.0.4-0.1.hum1
  • redis Debian 13 5:8.0.2-3+deb13u3
  • redis Debian 14 5:8.0.6-3
  • valkey Debian 13 8.1.1+dfsg1-3+deb13u3
  • valkey Debian 14 9.1.1-1

debian advisories DEBIAN-CVE-2026-23479

  • boost hummingbird 1 1.90.0-7.hum1
  • boost-b2 hummingbird 1 1.90.0-7.hum1
  • boost-log hummingbird 1 1.90.0-7.hum1
  • boost-url hummingbird 1 1.90.0-7.hum1
  • boost-json hummingbird 1 1.90.0-7.hum1
  • boost-math hummingbird 1 1.90.0-7.hum1
  • boost-test hummingbird 1 1.90.0-7.hum1
  • boost-wave hummingbird 1 1.90.0-7.hum1

red hat advisories RHSA-2026:7662RHSA-2026:14316RHSA-2026:26540RHSA-2026:26306RHSA-2026:25925RHSA-2026:25219

  • redis openSUSE Leap 16.0 8.10.1-bp160.1.1
  • redis-modules openSUSE Leap 16.0 8.10.1-bp160.1.1
  • valkey openSUSE Tumbleweed 9.0.4-1.1
  • redis openSUSE Tumbleweed 8.6.3-1.1

opensuse advisories openSUSE-SU-2026:21612-1openSUSE-SU-2026:10719-1openSUSE-SU-2026:10711-1

  • valkey AlmaLinux 9 8.0.9-1.el9_8
  • valkey AlmaLinux 10 8.0.9-1.el10_2
  • redis AlmaLinux 9 7.2.14-1.module_el9.8.0+258+b8f945d3

almalinux advisories ALSA-2026:25925ALSA-2026:25216ALSA-2026:25219

  • valkey Rocky Linux 9 8.0.9-1.el9_8
  • valkey Rocky Linux 10 8.0.9-1.el10_2
  • redis Rocky Linux 9 7.2.14-1.module+el9.8.0+40207+e2014501

rocky linux advisories RLSA-2026:25925RLSA-2026:25216RLSA-2026:25219

  • valkey Alpine 3.21, Alpine 3.20 7.2.13-r0
  • valkey Alpine 3.22 8.1.7-r0
  • valkey Alpine 3.24, Alpine 3.23 9.0.4-r0

alpine advisories ALPINE-CVE-2026-23479

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • valkey Azure Linux 3.0 8.0.9-1

azure linux advisories AZL-86093

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-23479 updated cvss 7.5

redis: use-after-free in unblock client flow may allow remote code execution

  • Red Hat Enterprise Linux AppStream (v. 9) valkey 8.0.9-1.el9_8, redis 7.2.14-1.module+el9.8.0+24327+41ceb644
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2026:25219
  • Red Hat Enterprise Linux AppStream (v. 10) valkey 8.0.9-1.el10_2
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2026:25216
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) valkey 8.0.9-1.el10_0
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2026:26540
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) redis 7.2.14-1.module+el9.6.0+24344+1bc33ec7
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2026:26306
  • Red Hat Hardened Images boost 1.90.0-7.hum1, valkey 9.0.4-0.1.hum1, boost-b2 1.90.0-7.hum1, boost-log 1.90.0-7.hum1, boost-url 1.90.0-7.hum1, boost-json 1.90.0-7.hum1, +40 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2026:7662
  • Red Hat Enterprise Linux 8 redis Red Hat Enterprise Linux 9 redis
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
6 mo ago

Exploit prediction

2.61% chance of exploitation in the next 30 days, higher than 85% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 7.7 CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA 4.0 7.7 CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
bitnami keydb
>=7.2.0, <7.2.14
>=7.3.0, <7.4.9
>=8.0.0, <8.2.6
>=8.3.0, <8.4.3
>=8.5.0, <8.6.3
7.2.14
7.4.9
8.2.6
8.4.3
8.6.3
bitnami redis
>=7.2.0, <7.2.14
>=7.3.0, <7.4.9
>=8.0.0, <8.2.6
>=8.3.0, <8.4.3
>=8.5.0, <8.6.3
7.2.14
7.4.9
8.2.6
8.4.3
8.6.3
bitnami valkey
<7.2.13
>=8.0.0, <8.0.8
>=8.1.0, <8.1.7
>=9.0.0, <9.0.4
7.2.13
8.0.8
8.1.7
9.0.4

Affected products

  • redis redis
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support
  • Red Hat Red Hat Hardened Images
  • Red Hat Red Hat Enterprise Linux 8

Classification

Weakness
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

The maintainers of redis/redis published their own advisory on GitHub. Reviewed sources take precedence over it.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.