Skip to content
Fencer Vulns
high 8.8

CVE-2026-23631 json

redis-server Lua use-after-free may allow remote code execution

published 2026-05-05 6 mo ago modified 2026-09-10 59 d ago also BIT-keydb-2026-23631 , BIT-redis-2026-23631 , BIT-valkey-2026-23631 , EUVD-2026-27398 , GHSA-8ghh-qpmp-7826

cvss
8.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
3.1%
EPSS 3.1% chance of exploitation in 30 days, percentile 87%
public exploits
0
none known

Summary

Redis is an in-memory data structure store. In all versions of redis-server with Lua scripting, an authenticated attacker can exploit the master-replica synchronization mechanism to trigger a use-after-free on replicas where replica-read-only is disabled or can be disabled, which may lead to remote code execution. A workaround is to prevent users from executing Lua scripts or avoid using replicas where replica-read-only is disabled. This is patched in version 8.6.3.

Patch / fix

  • bitnami keydb 7.2.14, 7.4.9, 8.2.6, 8.4.3, 8.6.3
  • bitnami redis 7.2.14, 7.4.9, 8.2.6, 8.4.3, 8.6.3
  • bitnami valkey 7.2.13, 8.0.8, 8.1.7, 9.0.4
  • Red Hat Red Hat Enterprise Linux 10 0:8.0.9-1.el10_2
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support 0:8.0.9-1.el10_0
  • Red Hat Red Hat Enterprise Linux 9 0:8.0.9-1.el9_8, 9080020260521083756.9
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 9040020260625094332.9
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support 9060020260602115714.9
  • Red Hat Red Hat Hardened Images 9.0.4-0.1.hum1
  • redis Debian 12 5:7.0.15-1~deb12u8
  • redis Debian 13 5:8.0.2-3+deb13u3
  • redis Debian 14 5:8.0.6-3
  • valkey Debian 13 8.1.1+dfsg1-3+deb13u3
  • valkey Debian 14 9.1.1-1

debian advisories DEBIAN-CVE-2026-23631

  • valkey hummingbird 1 9.0.4-0.1.hum1
  • valkey-rdma hummingbird 1 9.0.4-0.1.hum1
  • valkey-compat-redis hummingbird 1 9.0.4-0.1.hum1
  • valkey RHEL 9 8.0.9-1.el9_8
  • redis RHEL 9 7.2.14-1.module+el9.8.0+24327+41ceb644
  • valkey RHEL 10.2 8.0.9-1.el10_2
  • redis RHEL 9.4 E4S 7.0.12-2.module+el9.4.0+24450+e284b512.8
  • valkey enterprise linux eus 10.0 8.0.9-1.el10_0

red hat advisories RHSA-2026:14316RHSA-2026:33444RHSA-2026:26540RHSA-2026:26306RHSA-2026:25925RHSA-2026:25219

  • redis openSUSE Leap 16.0 8.10.1-bp160.1.1
  • redis-modules openSUSE Leap 16.0 8.10.1-bp160.1.1
  • valkey openSUSE Tumbleweed 9.0.4-1.1
  • redis openSUSE Tumbleweed 8.6.3-1.1

opensuse advisories openSUSE-SU-2026:21612-1openSUSE-SU-2026:10719-1openSUSE-SU-2026:10711-1

  • valkey AlmaLinux 9 8.0.9-1.el9_8
  • valkey AlmaLinux 10 8.0.9-1.el10_2
  • redis AlmaLinux 9 7.2.14-1.module_el9.8.0+258+b8f945d3

almalinux advisories ALSA-2026:25925ALSA-2026:25216ALSA-2026:25219

  • valkey Rocky Linux 9 8.0.9-1.el9_8
  • valkey Rocky Linux 10 8.0.9-1.el10_2
  • redis Rocky Linux 9 7.2.14-1.module+el9.8.0+40207+e2014501

rocky linux advisories RLSA-2026:25925RLSA-2026:25216RLSA-2026:25219

  • valkey Alpine 3.21, Alpine 3.20 7.2.13-r0
  • valkey Alpine 3.22 8.1.7-r0
  • valkey Alpine 3.24, Alpine 3.23 9.0.4-r0

alpine advisories ALPINE-CVE-2026-23631

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • valkey Azure Linux 3.0 8.0.9-1

azure linux advisories AZL-86084

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-23631 updated cvss 8.8

redis: Remote code execution via use-after-free in Lua scripting

  • Red Hat Enterprise Linux AppStream (v. 9) valkey 8.0.9-1.el9_8, redis 7.2.14-1.module+el9.8.0+24327+41ceb644
    fixed: vendor fix RHSA-2026:25219
  • Red Hat Enterprise Linux AppStream (v. 10) valkey 8.0.9-1.el10_2
    fixed: vendor fix RHSA-2026:25216
  • Red Hat Enterprise Linux AppStream E4S (v.9.4) redis 7.0.12-2.module+el9.4.0+24450+e284b512.8
    fixed: vendor fix RHSA-2026:33444
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) valkey 8.0.9-1.el10_0
    fixed: vendor fix RHSA-2026:26540
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) redis 7.2.14-1.module+el9.6.0+24344+1bc33ec7
    fixed: vendor fix RHSA-2026:26306
  • Red Hat Hardened Images valkey 9.0.4-0.1.hum1, valkey-rdma 9.0.4-0.1.hum1, valkey-compat-redis 9.0.4-0.1.hum1
    fixed: vendor fix RHSA-2026:14316
  • Red Hat Enterprise Linux 8 redis Red Hat Enterprise Linux 9 redis
    not affected: vulnerable code not present
  • Red Hat Hardened Images boost 1.90.0-7.hum1
    not affected: vulnerable code not in execute path

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
6 mo ago

Exploit prediction

3.09% chance of exploitation in the next 30 days, higher than 87% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 6.1 CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADP 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA 4.0 6.1 CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CNA 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
OSV 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
bitnami keydb
>=7.2.0, <7.2.14
>=7.3.0, <7.4.9
>=8.0.0, <8.2.6
>=8.3.0, <8.4.3
>=8.5.0, <8.6.3
7.2.14
7.4.9
8.2.6
8.4.3
8.6.3
bitnami redis
>=7.2.0, <7.2.14
>=7.3.0, <7.4.9
>=8.0.0, <8.2.6
>=8.3.0, <8.4.3
>=8.5.0, <8.6.3
7.2.14
7.4.9
8.2.6
8.4.3
8.6.3
bitnami valkey
<7.2.13
>=8.0.0, <8.0.8
>=8.1.0, <8.1.7
>=9.0.0, <9.0.4
7.2.13
8.0.8
8.1.7
9.0.4

Affected products

  • redis redis
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support
  • Red Hat Red Hat Hardened Images
  • Red Hat Red Hat Enterprise Linux 8

Classification

Weakness
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

The maintainers of redis/redis published their own advisory on GitHub. Reviewed sources take precedence over it.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.