CVE-2026-23479

Description

Redis is an in-memory data structure store. In redis-server from 7.2.0 until 8.6.3, the unblock client flow does not handle an error return from `processCommandAndResetClient` when re-executing a blocked command. If a blocked client is evicted during this flow, an authenticated attacker can trigger a use-after-free that may lead to remote code execution. This has been patched in version 8.6.3.

How to fix CVE-2026-23479

To remediate CVE-2026-23479, upgrade the affected package to a fixed version below.

• —upgrade to 7.2.13-r0 or later
• —upgrade to 7.2.14 or later
• —upgrade to 7.2.14 or later
• —upgrade to 7.2.13 or later
• —no fix listed

Is CVE-2026-23479 being exploited?

Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.

Affected packages (5)

• from 0, < 7.2.13-r0
• >= 7.2.0, < 7.2.14, >= 7.3.0, < 7.4.9, >= 8.0.0, < 8.2.6, >= 8.3.0, < 8.4.3, >= 8.5.0, < 8.6.3
• >= 7.2.0, < 7.2.14, >= 7.3.0, < 7.4.9, >= 8.0.0, < 8.2.6, >= 8.3.0, < 8.4.3, >= 8.5.0, < 8.6.3
• from 0, < 7.2.13, >= 8.0.0, < 8.0.8, >= 8.1.0, < 8.1.7, >= 9.0.0, < 9.0.4
• from 0

CVSS scores

References (5)

• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2026-23479
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2026-23479
• WEBgithub.com/redis/redis/releases/tag/8.6.3
• WEBgithub.com/redis/redis/security/advisories/GHSA-93m2-935m-8rj3
• WEB