CVE-2026-23479

Name of the Vulnerable Software and Affected Versions redis-server versions 7.2.0 through 8.6.3

Description An authenticated attacker can trigger a use-after-free condition in the unblock client flow when a blocked client is evicted. This occurs because the system does not properly handle an error return from the processCommandAndResetClient() function when re-executing a blocked command. This flaw can be exploited to execute arbitrary OS commands on the server. The exploitation chain involves using a Lua script to leak a heap pointer, grooming client memory, and overwriting a function pointer in the Global Offset Table to redirect a standard string function to system(). This issue was present in all stable branches for over two years and is particularly critical for default deployments that lack passwords or use overly permissive roles.

Recommendations Update redis-server to version 7.2.14 or later. Update redis-server to version 7.4.9 or later. Update redis-server to version 8.2.6 or later. Update redis-server to version 8.4.3 or later. Update redis-server to version 8.6.3 or later. As a temporary mitigation, disable Lua scripting if it is not required to break the exploit chain. Restrict Redis access to trusted networks and avoid exposing the service directly to the internet. Tighten Access Control Lists (ACLs) to ensure no single role possesses both u/admin and u/scripting permissions simultaneously.