CVE-2026-23479
EUVD-2026-2739605.05.2026, 17:17
Redis is an in-memory data structure store. In redis-server from 7.2.0 until 8.6.3, the unblock client flow does not handle an error return from `processCommandAndResetClient` when re-executing a blocked command. If a blocked client is evicted during this flow, an authenticated attacker can trigger a use-after-free that may lead to remote code execution. This has been patched in version 8.6.3.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| redis | redis | 7.2.0 ≤ 𝑥 < 8.6.3 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | 0:8.0.9-1.el10_2 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | 0:8.0.9-1.el10_0 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 9 | 9080020260521083756.9 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 9 | 0:8.0.9-1.el9_8 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | 9060020260602115714.9 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Hardened Images | 9.0.4-0.1.hum1 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Hardened Images | 1.90.0-7.hum1 ≤ 𝑥 < * | ADP |
Debian Releases
Ubuntu Releases
openSUSE / SLES Releases
openSUSE Product | |||||||
|---|---|---|---|---|---|---|---|
| redis |
| ||||||
| valkey |
| ||||||
| valkey-compat-redis |
| ||||||
| valkey-devel |
|
Red Hat Enterprise Linux Releases
Amazon Linux Releases
Common Weakness Enumeration
References