CVE-2026-23631

Description

Redis is an in-memory data structure store. In all versions of redis-server with Lua scripting, an authenticated attacker can exploit the master-replica synchronization mechanism to trigger a use-after-free on replicas where replica-read-only is disabled or can be disabled, which may lead to remote code execution. A workaround is to prevent users from executing Lua scripts or avoid using replicas where replica-read-only is disabled. This is patched in version 8.6.3.

How to fix CVE-2026-23631

To remediate CVE-2026-23631, upgrade the affected package to a fixed version below.

• —upgrade to 7.2.13-r0 or later
• —upgrade to 7.2.14 or later
• —upgrade to 7.2.14 or later
• —upgrade to 7.2.13 or later
• —no fix listed

Is CVE-2026-23631 being exploited?

Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.

Affected packages (5)

• from 0, < 7.2.13-r0
• >= 7.2.0, < 7.2.14, >= 7.3.0, < 7.4.9, >= 8.0.0, < 8.2.6, >= 8.3.0, < 8.4.3, >= 8.5.0, < 8.6.3
• >= 7.2.0, < 7.2.14, >= 7.3.0, < 7.4.9, >= 8.0.0, < 8.2.6, >= 8.3.0, < 8.4.3, >= 8.5.0, < 8.6.3
• from 0, < 7.2.13, >= 8.0.0, < 8.0.8, >= 8.1.0, < 8.1.7, >= 9.0.0, < 9.0.4
• from 0

CVSS scores

References (5)

• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2026-23631
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2026-23631
• WEBgithub.com/redis/redis/releases/tag/8.6.3
• WEBgithub.com/redis/redis/security/advisories/GHSA-8ghh-qpmp-7826
• WEB