Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the privileges of the Redis server.

Rejected reason: Red Hat CNA-LR concluded that this CVE is not valid.

Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer, because deleting both consumers via XGROUP DELCONSUMER leads to a double free. NOTE: this issue exists because of an incomplete fix for CVE-2026-25243.

On May 5, Redis published this advisory, which doesn't seem to have made it to oss-security yet: https://redis.io/blog/security-advisory-cve202623479-cve202625243-cve-2026-25588-cve202625589-cve-2026-23631/

The portions relating to their open-source releases are as follows: What happened? -------------- As part of an ongoing effort by the Redis community and Redis to maintain safety, security, and compliance posture, five security vulnerabilities in Redis have been proactively identified and remediated in the versions indicated below.

What are the vulnerabilities? ----------------------------- 1. CVE‑2026‑23479 – Use-After-Free in unblock client flow may lead to Remote Code Execution. CVSS Score: 7.7 (High)

When a blocked client is evicted while re-executing a blocked command, an authenticated user may trigger a use-after-free and potentially lead to remote code execution. The code doesn't handle the case where processing the command (processCommandAndResetClient) returns an error value.

2. CVE‑2026‑25243 – Invalid Memory Access in Redis RESTORE Command May Lead to Remote Code Execution. CVSS Score: 7.7 (High)

A vulnerability in the Redis RESTORE command allows an authenticated user to trigger an invalid memory access via a specially crafted serialized payload, potentially resulting in remote code execution.

Successful exploitation could allow an attacker with authenticated access to execute arbitrary code in the context of the Redis server, potentially leading to full compromise of the affected system, data exfiltration, or service disruption.

3. CVE-2026-25588 - Invalid Memory Access in RESTORE Command When Used with RedisTimeSeries module May Lead to Remote Code Execution. CVSS Score: 7.7 (High)

A vulnerability in the RESTORE command, when used with the RedisTimeSeries module, allows an authenticated attacker to trigger invalid memory access via a specially crafted serialized payload, potentially resulting in remote code execution.

Successful exploitation could allow an attacker with authenticated access to execute arbitrary code in the context of the Redis server, when used with the RedisTimeSeries module, potentially leading to full compromise of the affected system, data exfiltration, or service disruption.

4. CVE‑2026‑25589 – Invalid Memory Access in RESTORE Command When Used with RedisBloom module May Lead to Remote Code Execution. CVSS Score: 7.7 (High)

A vulnerability in the RESTORE command, when used with the RedisBloom module, allows an authenticated attacker to trigger invalid memory access via a specially crafted serialized payload, potentially resulting in remote code execution.

Successful exploitation could allow an attacker with authenticated access to execute arbitrary code in the context of the Redis server, when used with the RedisBloom module, potentially leading to full compromise of the affected system, data exfiltration, or service disruption.

5. CVE-2026-23631 - Lua Use-After-Free may lead to remote code execution. CVSS Score: 6.1 (Medium)

An authenticated user may exploit the synchronization mechanism of the master-replica and trigger a use-after-free vulnerability, potentially leading to remote code execution. The bug affects only replicas that are configured, or may be configured with replica-read-only disabled, and exists in all versions of Redis with Lua scripting.

How can you protect your Redis instance? ----------------------------------------

If you’re self-managing Redis Software, Open Source (OSS), or Community (CE) versions, there are several steps you should take to protect your Redis from exploitation. Exposure to these vulnerabilities requires an attacker to gain authenticated access to your Redis instance, making this a post-authentication issue that can lead to remote code execution (RCE).

To remediate against these vulnerabilities, upgrade your Redis to the latest versions, see our table below for full details. To minimize the risk of exploitation, it’s important to follow these best practices:

Restrict Network Access: Ensure that only authorized users and systems have access to the Redis database. Use firewalls and network policies to limit access to trusted sources and prevent unauthorized connectivity. Enforce Strong Authentication: Enforce the use of credentials for all access to Redis instances. Avoid configurations that allow unauthenticated access, and ensure protected-mode is enabled (in CE and OSS) to prevent accidental exposure. Limit Permissions: Ensure that user identities with access to Redis are granted the minimum permissions necessary. Only allow trusted identities to run potentially risky commands. Update Regularly: Keep Redis updated to the latest version for the newest security patches.

For more details on how to securely configure, deploy, and use Redis, visit the Community Edition documentation sites.

Am I impacted and how can I remediate? --------------------------------------

If you’re self-managing Redis, upgrade your Redis to the latest release.

The versions of Redis OSS/CE listed below and future versions include the corrections. Once the upgrades are performed, the vulnerability will be remediated in your environment.

You can download the latest versions here: https://redis.io/downloads/

Vulnerability Impacted releases Fixed releases ------------- ----------------- -------------- CVE-2026-23479 All Redis OSS/CE releases OSS/CE 6.2.22, 7.2.14, 7.4.9, 8.2.6, 8.4.3, 8.6.3

CVE-2026-25243 All Redis OSS/CE releases OSS/CE 6.2.22, 7.2.14, 7.4.9, 8.2.6, 8.4.3, 8.6.3

CVE-2026-25588 All Redis OSS/CE releases OSS/CE 6.2.22, 7.2.14, 7.4.9, 8.2.6, 8.4.3, 8.6.3, Redistimeseries v1.12.14, v1.10.24, v1.8.23

CVE-2026-25589 All Redis OSS/CE releases OSS/CE 6.2.22, 7.2.14, 7.4.9, 8.2.6, 8.4.3, 8.6.3, RedisBloom: v2.8.20, v2.6.28, v2.4.23

CVE-2026-23631 All Redis OSS releases OSS/CE 6.2.22, 7.2.14, 7.4.9, where replica-read-only 8.2.6, 8.4.3, 8.6.3 is disabled

How can I tell if I was already exposed and how can I identify exploitation? ----------------------------------------------------------------------------

Refer to the table above to identify if you are on a vulnerable version.

As of this publication we have no evidence of exploitation of these vulnerabilities at Redis or in customer environments.

This isn’t a comprehensive guide, but it is a general recommendation you can adapt to your needs and operating environment.

There are a number of technical and behavioral indicators or artifacts that may be created if exploitation of the vulnerability occurred. If you search for these within your Redis environment, you should be able to detect potential exploitation related to your Redis instance.

Access to the Redis database from unauthorized or unknown sources Unknown or anomalous network ingress traffic to the Redis database Unexplained Redis server crashes, specifically crashes with a stack trace that originates from the Lua engine Unknown, unexpected, or anomalous command execution by the redis-server user Unknown or anomalous network egress traffic (or attempts) from the Redis database Unknown or anomalous changes to the file system, in particular in directories that host Redis persistent or configuration files

Who gets the credit? --------------------

We thank the following researchers for their vigilance in reporting these vulnerabilities through our published process. We would also like to thank Wiz for the partnership and hosting Wiz ZeroDay.Cloud, where a number of these vulnerabilities were identified:

CVE‑2026‑23479 reported by independent researchers Team Xint Code (Tim Becker @tjbecker, Jacob Newman, and Juno IM) CVE‑2026‑25243 the following issues were reported by: - Redis: double-free, discovered by independent researcher Emil Lerner (@emillerner) - VectorSets - Integer overflow and Out-Of-Bounds read. discovered by the independent researcher Joseph Surin. CVE-2026-25588 discovered by independent researchers Team Skateboarding Dog (Joseph Surin, John Stephenson, and Annie Nie) CVE‑2026‑25589 – the following issues were reported by: - RedisBloom: Out-Of-Bounds read/write, discovered by Daniel Firer - RedisBloom - Integer overflow, heap buffer overflow, and Out-Of-Bounds read/write, discovered by independent researcher Joseph Surin. CVE-2026-23631 discovered by independent researcher Yoni Sherez (@yoyosh) On June 2, Wiz published blogs with detailed reports at: - https://www.zeroday.cloud/blog/redis-five-cves-overview - https://www.zeroday.cloud/blog/redis-cve-2026-23479-deep-dive - https://www.zeroday.cloud/blog/redis-cve-2026-23631-dark-replica - https://www.zeroday.cloud/blog/redis-cve-2026-25243-deep-dive

-- -Alan Coopersmith- alan.coopersmith () oracle com Oracle Solaris Engineering - https://blogs.oracle.com/solaris

CVE-2026-23479 has been sitting in Redis since 7.2.0, introduced in mid-2023 across two separate commits that were not dangerous individually but created a use-after-free condition together. It survived multiple rounds of security review and remained in every stable branch until patches landed on May 5. The flaw was not found by a human security researcher going through the code. An autonomous AI tool called Xint Code, built by Theori specifically to hunt bugs in large codebases, found it at Wiz's ZeroDay.Cloud hacking competition in London last December. The full technical writeup and working exploit chain are now public. Here's why this matters beyond the patch urgency. Redis runs in roughly 75% of cloud environments according to Wiz. Most of those instances run without a password. The exploit technically requires an authenticated session, but in a default Redis deployment the default user already holds every permission the attack chain needs: u/admin, u/scripting, u/stream, and read/write access. So for a significant portion of exposed instances, the authentication requirement is not much of a barrier in practice. The exploit itself is a three-stage chain. First a one-line Lua script leaks a heap pointer. Then the attacker grooms client memory, parks a large client on a stream, drops the memory limits to trigger the free, and immediately reclaims the freed slot with a fake client structure via a pipelined SET. Finally Redis's own memory accounting routine gets turned against itself to overwrite a function pointer in the Global Offset Table, redirecting a standard string function to system(). The next command Redis parses runs as a shell command on the host. The official Redis Docker image makes the last step easier because it ships with only partial RELRO, leaving the GOT writable at runtime. ASLR and PIE do not help here since the write targets a global with a fixed offset at build time. Patches are out. Minor upgrades within a series are designed to be drop-in, so there is no good reason to delay. If you are on a managed Redis service, check your provider's status. Redis Cloud is already patched. Patched versions by branch: 7.2.x fixed in 7.2.14, 7.4.x fixed in 7.4.9, 8.2.x fixed in 8.2.6, 8.4.x fixed in 8.4.3, 8.6.x fixed in 8.6.3. If patching immediately is not possible, keep Redis off the public internet, put it behind TLS, tighten ACLs so no single role holds u/admin and u/scripting together, and disable Lua scripting entirely if you do not use it. That last step kills Stage 1 of the exploit chain. Worth noting this is one of five RCE-class Redis flaws disclosed in the same May 5 advisory. CVE-2026-23479 is the one that got the full public exploit writeup, but the others are worth reviewing too. Redis's official security advisory covers all five. This assumes some familiarity with your environment and Redis configuration. If any of this is unclear, drop a comment and the community or myself can help.

After FIOD seized 800+ servers and arrested two operators on May 18, the ELLIO research team reports that scanning from the network's ASN ranges has continued largely uninterrupted - and that while roughly a third of the recently-active ranges (including the legacy Stark blocks 94.131.105.0/24 and 92.118.232.0/24) have since been withdrawn from global routing, the surviving ranges under AS209847 (WorkTitans / THE.Hosting) are still announced and still scanning, at the network's normal daily rate.

The sibling ASNs (AS213999 and the Moscow-based AS33993) remain routed and idle.

The recent activity skews toward database and ICS/SCADA discovery = MongoDB, Redis, PostgreSQL, Oracle, LDAP, plus DNP3 and EtherNet/IP - alongside known-exploit probes like CVE-2017-17215 and WinRM.

Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This is patched in version 8.6.3.

Redis is an in-memory data structure store. In all versions of redis-server with Lua scripting, an authenticated attacker can exploit the master-replica synchronization mechanism to trigger a use-after-free on replicas where replica-read-only is disabled or can be disabled, which may lead to remote code execution. A workaround is to prevent users from executing Lua scripts or avoid using replicas where replica-read-only is disabled. This is patched in version 8.6.3.

Redis is an in-memory data structure store. In redis-server from 7.2.0 until 8.6.3, the unblock client flow does not handle an error return from processCommandAndResetClient when re-executing a blocked command. If a blocked client is evicted during this flow, an authenticated attacker can trigger a use-after-free that may lead to remote code execution. This has been patched in version 8.6.3.

RedisTimeSeries is a time-series module for Redis. In all versions before 1.12.14 of RedisTimeSeries, the module does not properly validate serialized values processed through the Redis RESTORE command. An authenticated attacker with permission to execute RESTORE on a server with the RedisTimeSeries module loaded can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This has been patched in version 1.12.14.

Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This is patched in version 8.6.3.

Redis is an in-memory data structure store. In all versions of redis-server with Lua scripting, an authenticated attacker can exploit the master-replica synchronization mechanism to trigger a use-after-free on replicas where replica-read-only is disabled or can be disabled, which may lead to remote code execution. A workaround is to prevent users from executing Lua scripts or avoid using replicas where replica-read-only is disabled. This is patched in version 8.6.3.

Redis is an in-memory data structure store. In redis-server from 7.2.0 until 8.6.3, the unblock client flow does not handle an error return from processCommandAndResetClient when re-executing a blocked command. If a blocked client is evicted during this flow, an authenticated attacker can trigger a use-after-free that may lead to remote code execution. This has been patched in version 8.6.3.

Redis is an open source, in-memory database that persists on disk. In versions 8.2.0 and above, a user can run the XACKDEL command with multiple ID's and trigger a stack buffer overflow, which may potentially lead to remote code execution. This issue is fixed in version 8.2.3. To workaround this issue without patching the redis-server executable is to prevent users from executing XACKDEL operation. This can be done using ACL to restrict XACKDEL command.

I haven't seen it here on this list yet, so forwarding:

There's an RCE vulnerability in Redis with a CVSS Score of 9.9 (although advertised as 10.0):

https://nvd.nist.gov/vuln/detail/CVE-2025-49844 https://github.com/redis/redis/security/advisories/GHSA-4789-qfc9-5f9q

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Impact

An authenticated user may use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code execution.

The problem exists in all versions of Redis with Lua scripting.

Workarounds

An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands. Credit

The problem was reported by Wiz researchers Benny Isaacs (@bennyisaacs), Nir Brakha, Sagi Tzadik (@sagitz) working with Trend Micro, Zero Day Initiative

---

Additional link, which assesses the vulnerability based on the how many exposed instances don't require authentication:

https://www.wiz.io/blog/wiz-research-redis-rce-cve-2025-49844

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Redis. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8. The following CVEs are assigned: CVE-2025-49844.

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Redis. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8. The following CVEs are assigned: CVE-2025-49844.

Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.

Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted LUA script to read out-of-bound data or crash the server and subsequent denial of service. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to block a script by restricting both the EVAL and FUNCTION command families.

Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.

Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted LUA script to read out-of-bound data or crash the server and subsequent denial of service. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to block a script by restricting both the EVAL and FUNCTION command families.

Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate different LUA objects and potentially run their own code in the context of another user. The problem exists in all versions of Redis with LUA scripting. This issue is fixed in version 8.2.2. A workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing LUA scripts. This can be done using ACL to block a script by restricting both the EVAL and FUNCTION command families.

Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate different LUA objects and potentially run their own code in the context of another user. The problem exists in all versions of Redis with LUA scripting. This issue is fixed in version 8.2.2. A workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing LUA scripts. This can be done using ACL to block a script by restricting both the EVAL and FUNCTION command families.

Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to cause an integer overflow and potentially lead to remote code execution The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2.

Lua library commands may lead to integer overflow and potential RCE

Redis through 8.0.3 allows memory consumption via a multi-bulk command composed of many bulks, sent by an authenticated user. This occurs because the server allocates memory for the command arguments of every bulk, even when the command is skipped because of insufficient permissions. NOTE: this is disputed by the Supplier because abuse of the commands network protocol is not a violation of the Redis Security Model.

Redis is an open source, in-memory database that persists on disk. From 2.8 to before 8.0.3, 7.4.5, 7.2.10, and 6.2.19, an authenticated user may use a specially crafted string to trigger a stack/heap out of bounds write on hyperloglog operations, potentially leading to remote code execution. The bug likely affects all Redis versions with hyperloglog operations implemented. This vulnerability is fixed in 8.0.3, 7.4.5, 7.2.10, and 6.2.19. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing hyperloglog operations. This can be done using ACL to restrict HLL commands.

Redis is an open source, in-memory database that persists on disk. An unauthenticated connection can cause repeated IP protocol errors, leading to client starvation and, ultimately, a denial of service. This vulnerability is fixed in 8.0.3, 7.4.5, 7.2.10, and 6.2.19.