Source: redis X-Debbugs-CC: [email protected] Severity: grave Tags: security
Hi, The following vulnerabilities were published for redis and are fixed in 8.6.3 and later: CVE-2026-23479[0]: | Redis is an in-memory data structure store. In redis-server from | 7.2.0 until 8.6.3, the unblock client flow does not handle an error | return from `processCommandAndResetClient` when re-executing a | blocked command. If a blocked client is evicted during this flow, an | authenticated attacker can trigger a use-after-free that may lead to | remote code execution. This has been patched in version 8.6.3. https://github.com/redis/redis/security/advisories/GHSA-93m2-935m-8rj3 https://www.zeroday.cloud/blog/redis-cve-2026-23479-deep-dive Fixed by: https://github.com/redis/redis/commit/c14e9925e571c3c8ecbeb8632fe834faa32175ea (8.6.3) CVE-2026-23631[1]: | Redis is an in-memory data structure store. In all versions of | redis-server with Lua scripting, an authenticated attacker can | exploit the master-replica synchronization mechanism to trigger a | use-after-free on replicas where replica-read-only is disabled or | can be disabled, which may lead to remote code execution. A | workaround is to prevent users from executing Lua scripts or avoid | using replicas where replica-read-only is disabled. This is patched | in version 8.6.3. https://github.com/redis/redis/security/advisories/GHSA-8ghh-qpmp-7826 https://www.zeroday.cloud/blog/redis-cve-2026-23631-dark-replica Fixed by: https://github.com/redis/redis/commit/0cca172a174642bdae03b871615227896274d9bb (8.6.3) CVE-2026-25243[2]: | Redis is an in-memory data structure store. In versions of redis- | server up to 8.6.3, the RESTORE command does not properly validate | serialized values. An authenticated attacker with permission to | execute RESTORE can supply a crafted serialized payload that | triggers invalid memory access and may lead to remote code | execution. A workaround is to restrict access to the RESTORE command | with ACL rules. This is patched in version 8.6.3. https://github.com/redis/redis/security/advisories/GHSA-c8h9-259x-jff4 https://www.zeroday.cloud/blog/redis-cve-2026-25243-deep-dive Fixed by: https://github.com/redis/redis/commit/b9dde6fc25dec6191b18374335a076a7b31e3d02 (8.6.3) If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-23479 https://www.cve.org/CVERecord?id=CVE-2026-23479 [1] https://security-tracker.debian.org/tracker/CVE-2026-23631 https://www.cve.org/CVERecord?id=CVE-2026-23631 [2] https://security-tracker.debian.org/tracker/CVE-2026-25243 https://www.cve.org/CVERecord?id=CVE-2026-25243 Please adjust the affected versions in the BTS as needed.
