CVE-2026-23479
Redis is an in-memory data structure store.
Published May 5, 2026 · updated Jul 25, 2026 · redis redis
Redis is an in-memory data structure store. In redis-server from 7.2.0 until 8.6.3, the unblock client flow does not handle an error return from when re-executing a blocked command. If a blocked client is evicted during this flow, an authenticated attacker can trigger a use-after-free that may lead to remote code execution. This has been patched in version 8.6.3.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
May 5, 2026 · NIST NVD
Detected
Redis is an in-memory data structure store. In redis-server from 7.2.0 until 8.6.3, the unblock client flow does not handle an error return from when re-executing a blocked command. If a blocked client is evicted during this flow, an authenticated attacker can trigger a use-after-free that may lead to remote code execution. This has been patched in version 8.6.3.
Jul 25, 2026 · NIST NVD
Updated
Redis is an in-memory data structure store. In redis-server from 7.2.0 until 8.6.3, the unblock client flow does not handle an error return from when re-executing a blocked command. If a blocked client is evicted during this flow, an authenticated attacker can trigger a use-after-free that may lead to remote code execution. This has been patched in version 8.6.3.
Affected
- cpe redis/redisversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-23479
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-23479
Redis is an in-memory data structure store. In redis-server from 7.2.0 until 8.6.3, the unblock client flow does not handle an error return from when re-executing a blocked command. If a blocked client is evicted during this flow, an authenticated a
nvd.nist.gov