CVE-2026-23631: redis-server Lua use-after-free may allow remote code execution
Redis is an in-memory data structure store. In all versions of redis-server with Lua scripting, an authenticated attacker can exploit the master-replica synchronization mechanism to trigger a use-after-free on replicas where replica-read-only is disabled or can be disabled, which may lead to remote code execution. A workaround is to prevent users from executing Lua scripts or avoid using replicas where replica-read-only is disabled. This is patched in version 8.6.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redis-serverto a version that resolves this vulnerability.Fixed in 8.6.3 - Configuration
Use the workaround by avoiding replicas where replica-read-only is disabled; enable replica-read-only so replicas are read-only during master-replica synchronization.
redis-server replica-read-only = enabled - Configuration
Use the workaround by preventing users from executing Lua scripts.
redis-server (Lua scripting) Lua script execution = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23631?
CVE-2026-23631 is classified as a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2026-23631?
To fix CVE-2026-23631, upgrade redis-server to version 8.6.4 or later.
Who is affected by CVE-2026-23631?
CVE-2026-23631 affects all versions of redis-server that utilize Lua scripting prior to 8.6.4.
What is the nature of the vulnerability in CVE-2026-23631?
CVE-2026-23631 is a use-after-free vulnerability that can be exploited during master-replica synchronization.
Can CVE-2026-23631 be exploited remotely?
Yes, CVE-2026-23631 can be exploited remotely by an authenticated attacker.