CVE-2026-23631
EUVD-2026-2739805.05.2026, 17:17
Redis is an in-memory data structure store. In all versions of redis-server with Lua scripting, an authenticated attacker can exploit the master-replica synchronization mechanism to trigger a use-after-free on replicas where replica-read-only is disabled or can be disabled, which may lead to remote code execution. A workaround is to prevent users from executing Lua scripts or avoid using replicas where replica-read-only is disabled. This is patched in version 8.6.3.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| redis | redis | 𝑥 < 8.6.3 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | 0:8.0.9-1.el10_2 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | 0:8.0.9-1.el10_0 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 9 | 9080020260521083756.9 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 9 | 0:8.0.9-1.el9_8 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | 9040020260625094332.9 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | 9060020260602115714.9 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Hardened Images | 9.0.4-0.1.hum1 ≤ 𝑥 < * | ADP |
Debian Releases
Ubuntu Releases
openSUSE / SLES Releases
openSUSE Product | |||||||
|---|---|---|---|---|---|---|---|
| redis |
| ||||||
| redis7 |
| ||||||
| valkey |
| ||||||
| valkey-compat-redis |
| ||||||
| valkey-devel |
|
Red Hat Enterprise Linux Releases
Amazon Linux Releases
Common Weakness Enumeration
References