CVE-2026-23479: redis-server use-after-free in unblock client flow may allow remote code execution
Redis is an in-memory data structure store. In redis-server from 7.2.0 until 8.6.3, the unblock client flow does not handle an error return from processCommandAndResetClient when re-executing a blocked command. If a blocked client is evicted during this flow, an authenticated attacker can trigger a use-after-free that may lead to remote code execution. This has been patched in version 8.6.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redis-serverto a version that resolves this vulnerability.Fixed in 8.6.3
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23479?
CVE-2026-23479 is classified as a critical vulnerability that may allow remote code execution.
How do I fix CVE-2026-23479?
To fix CVE-2026-23479, upgrade your Redis server to version 8.6.4 or later.
Which versions of Redis are affected by CVE-2026-23479?
CVE-2026-23479 affects Redis server versions from 7.2.0 to 8.6.3 inclusive.
What impact does CVE-2026-23479 have on my Redis server?
CVE-2026-23479 allows an attacker to exploit a use-after-free vulnerability, potentially leading to remote code execution.
Is there a workaround for CVE-2026-23479?
There is no known workaround for CVE-2026-23479; upgrading to a patched version is recommended.