Vulnerability-Lookup

SUSE-SU-2026:2099-1

Vulnerability from csaf_suse - Published: 2026-05-27 14:21 - Updated: 2026-09-16 19:38

Summary

Security update for redis

Severity

Important

Notes

Title of the patch: Security update for redis

Description of the patch: This update for redis fixes the following issues - CVE-2026-23479: use-after-free in unblock client flow may lead to remote code execution (bsc#1264164). - CVE-2026-23631: Lua use-after-free via the master-replica synchronization mechanism may lead to remote code execution (bsc#1264165). - CVE-2026-25243: invalid memory access in RESTORE command via a specially crafted serialized payload may lead to remote code execution (bsc#1264166).

Patchnames: SUSE-2026-2099,SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-2099,SUSE-SLE-Product-SLES_SAP-15-SP6-2026-2099

CVE-2026-23479

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 12 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:redis-7.2.4-150600.3.24.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:redis-7.2.4-150600.3.24.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:redis-7.2.4-150600.3.24.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:redis-7.2.4-150600.3.24.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:redis-7.2.4-150600.3.24.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:redis-7.2.4-150600.3.24.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:redis-7.2.4-150600.3.24.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:redis-7.2.4-150600.3.24.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:redis-7.2.4-150600.3.24.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:redis-7.2.4-150600.3.24.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:redis-7.2.4-150600.3.24.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:redis-7.2.4-150600.3.24.1.x86_64	—	Vendor Fix

Threats

Impact important

CVE-2026-23631

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 12 products, the same list as for CVE-2026-23479

Threats

Impact important

CVE-2026-25243

8.8 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 12 products, the same list as for CVE-2026-23479

Threats

Impact important

References

17 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/s…	self
https://www.suse.com/support/update/announcement/…	self
https://lists.suse.com/pipermail/sle-updates/2026…	self
https://bugzilla.suse.com/1264164	self
https://bugzilla.suse.com/1264165	self
https://bugzilla.suse.com/1264166	self
https://www.suse.com/security/cve/CVE-2026-23479/	self
https://www.suse.com/security/cve/CVE-2026-23631/	self
https://www.suse.com/security/cve/CVE-2026-25243/	self
https://www.suse.com/security/cve/CVE-2026-23479	external
https://bugzilla.suse.com/1264164	external
https://www.suse.com/security/cve/CVE-2026-23631	external
https://bugzilla.suse.com/1264165	external
https://www.suse.com/security/cve/CVE-2026-25243	external
https://bugzilla.suse.com/1264166	external
https://bugzilla.suse.com/1273162	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for redis",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for redis fixes the following issues\n\n- CVE-2026-23479: use-after-free in unblock client flow may lead to remote code execution (bsc#1264164).\n- CVE-2026-23631: Lua use-after-free via the master-replica synchronization mechanism may lead to remote code execution\n  (bsc#1264165).\n- CVE-2026-25243: invalid memory access in RESTORE command via a specially crafted serialized payload may lead to remote\n  code execution (bsc#1264166).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2026-2099,SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-2099,SUSE-SLE-Product-SLES_SAP-15-SP6-2026-2099",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_2099-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:2099-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-20262099-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:2099-1",
        "url": "https://lists.suse.com/pipermail/sle-updates/2026-May/046847.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1264164",
        "url": "https://bugzilla.suse.com/1264164"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1264165",
        "url": "https://bugzilla.suse.com/1264165"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1264166",
        "url": "https://bugzilla.suse.com/1264166"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-23479 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-23479/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-23631 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-23631/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-25243 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-25243/"
      }
    ],
    "title": "Security update for redis",
    "tracking": {
      "current_release_date": "2026-09-16T19:38:21Z",
      "generator": {
        "date": "2026-05-27T14:21:52Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:2099-1",
      "initial_release_date": "2026-05-27T14:21:52Z",
      "revision_history": [
        {
          "date": "2026-05-27T14:21:52Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-16T18:48:16Z",
          "number": "2",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-16T19:38:21Z",
          "number": "3",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "redis-7.2.4-150600.3.24.1.aarch64",
                "product": {
                  "name": "redis-7.2.4-150600.3.24.1.aarch64",
                  "product_id": "redis-7.2.4-150600.3.24.1.aarch64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:redis:redis:7.2.4:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/redis@7.2.4-150600.3.24.1?arch=aarch64\u0026upstream=redis-7.2.4-150600.3.24.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "redis-7.2.4-150600.3.24.1.i586",
                "product": {
                  "name": "redis-7.2.4-150600.3.24.1.i586",
                  "product_id": "redis-7.2.4-150600.3.24.1.i586",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:redis:redis:7.2.4:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/redis@7.2.4-150600.3.24.1?arch=i586\u0026upstream=redis-7.2.4-150600.3.24.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "redis-7.2.4-150600.3.24.1.ppc64le",
                "product": {
                  "name": "redis-7.2.4-150600.3.24.1.ppc64le",
                  "product_id": "redis-7.2.4-150600.3.24.1.ppc64le",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:redis:redis:7.2.4:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/redis@7.2.4-150600.3.24.1?arch=ppc64le\u0026upstream=redis-7.2.4-150600.3.24.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "redis-7.2.4-150600.3.24.1.s390x",
                "product": {
                  "name": "redis-7.2.4-150600.3.24.1.s390x",
                  "product_id": "redis-7.2.4-150600.3.24.1.s390x",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:redis:redis:7.2.4:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/redis@7.2.4-150600.3.24.1?arch=s390x\u0026upstream=redis-7.2.4-150600.3.24.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "redis-7.2.4-150600.3.24.1.x86_64",
                "product": {
                  "name": "redis-7.2.4-150600.3.24.1.x86_64",
                  "product_id": "redis-7.2.4-150600.3.24.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:redis:redis:7.2.4:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/redis@7.2.4-150600.3.24.1?arch=x86_64\u0026upstream=redis-7.2.4-150600.3.24.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 15 SP6-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise Server 15 SP6-LTSS",
                  "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles-ltss:15:sp6"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 15 SP6",
                "product": {
                  "name": "SUSE Linux Enterprise Server 15 SP6",
                  "product_id": "SUSE Linux Enterprise Server 15 SP6",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles:15:sp6"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP Applications 15 SP6",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP Applications 15 SP6",
                  "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_sap:15:sp6"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-7.2.4-150600.3.24.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:redis-7.2.4-150600.3.24.1.aarch64"
        },
        "product_reference": "redis-7.2.4-150600.3.24.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-7.2.4-150600.3.24.1.ppc64le as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:redis-7.2.4-150600.3.24.1.ppc64le"
        },
        "product_reference": "redis-7.2.4-150600.3.24.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-7.2.4-150600.3.24.1.s390x as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:redis-7.2.4-150600.3.24.1.s390x"
        },
        "product_reference": "redis-7.2.4-150600.3.24.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-7.2.4-150600.3.24.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:redis-7.2.4-150600.3.24.1.x86_64"
        },
        "product_reference": "redis-7.2.4-150600.3.24.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-7.2.4-150600.3.24.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6:redis-7.2.4-150600.3.24.1.aarch64"
        },
        "product_reference": "redis-7.2.4-150600.3.24.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-7.2.4-150600.3.24.1.ppc64le as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6:redis-7.2.4-150600.3.24.1.ppc64le"
        },
        "product_reference": "redis-7.2.4-150600.3.24.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-7.2.4-150600.3.24.1.s390x as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6:redis-7.2.4-150600.3.24.1.s390x"
        },
        "product_reference": "redis-7.2.4-150600.3.24.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-7.2.4-150600.3.24.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6:redis-7.2.4-150600.3.24.1.x86_64"
        },
        "product_reference": "redis-7.2.4-150600.3.24.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-7.2.4-150600.3.24.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:redis-7.2.4-150600.3.24.1.aarch64"
        },
        "product_reference": "redis-7.2.4-150600.3.24.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-7.2.4-150600.3.24.1.ppc64le as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:redis-7.2.4-150600.3.24.1.ppc64le"
        },
        "product_reference": "redis-7.2.4-150600.3.24.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-7.2.4-150600.3.24.1.s390x as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:redis-7.2.4-150600.3.24.1.s390x"
        },
        "product_reference": "redis-7.2.4-150600.3.24.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-7.2.4-150600.3.24.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:redis-7.2.4-150600.3.24.1.x86_64"
        },
        "product_reference": "redis-7.2.4-150600.3.24.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-23479",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-23479"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Redis is an in-memory data structure store. In redis-server from 7.2.0 until 8.6.3, the unblock client flow does not handle an error return from `processCommandAndResetClient` when re-executing a blocked command. If a blocked client is evicted during this flow, an authenticated attacker can trigger a use-after-free that may lead to remote code execution. This has been patched in version 8.6.3.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 15 SP6-LTSS:redis-7.2.4-150600.3.24.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:redis-7.2.4-150600.3.24.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:redis-7.2.4-150600.3.24.1.s390x",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:redis-7.2.4-150600.3.24.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:redis-7.2.4-150600.3.24.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP6:redis-7.2.4-150600.3.24.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP6:redis-7.2.4-150600.3.24.1.s390x",
          "SUSE Linux Enterprise Server 15 SP6:redis-7.2.4-150600.3.24.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:redis-7.2.4-150600.3.24.1.aarch64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:redis-7.2.4-150600.3.24.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:redis-7.2.4-150600.3.24.1.s390x",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:redis-7.2.4-150600.3.24.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-23479",
          "url": "https://www.suse.com/security/cve/CVE-2026-23479"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1264164 for CVE-2026-23479",
          "url": "https://bugzilla.suse.com/1264164"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 15 SP6-LTSS:redis-7.2.4-150600.3.24.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:redis-7.2.4-150600.3.24.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:redis-7.2.4-150600.3.24.1.s390x",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:redis-7.2.4-150600.3.24.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:redis-7.2.4-150600.3.24.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP6:redis-7.2.4-150600.3.24.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP6:redis-7.2.4-150600.3.24.1.s390x",
            "SUSE Linux Enterprise Server 15 SP6:redis-7.2.4-150600.3.24.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:redis-7.2.4-150600.3.24.1.aarch64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:redis-7.2.4-150600.3.24.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:redis-7.2.4-150600.3.24.1.s390x",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:redis-7.2.4-150600.3.24.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 15 SP6-LTSS:redis-7.2.4-150600.3.24.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:redis-7.2.4-150600.3.24.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:redis-7.2.4-150600.3.24.1.s390x",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:redis-7.2.4-150600.3.24.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:redis-7.2.4-150600.3.24.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP6:redis-7.2.4-150600.3.24.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP6:redis-7.2.4-150600.3.24.1.s390x",
            "SUSE Linux Enterprise Server 15 SP6:redis-7.2.4-150600.3.24.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:redis-7.2.4-150600.3.24.1.aarch64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:redis-7.2.4-150600.3.24.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:redis-7.2.4-150600.3.24.1.s390x",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:redis-7.2.4-150600.3.24.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-27T14:21:52Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-23479"
    },
    {
      "cve": "CVE-2026-23631",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-23631"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Redis is an in-memory data structure store. In all versions of redis-server with Lua scripting, an authenticated attacker can exploit the master-replica synchronization mechanism to trigger a use-after-free on replicas where replica-read-only is disabled or can be disabled, which may lead to remote code execution. A workaround is to prevent users from executing Lua scripts or avoid using replicas where replica-read-only is disabled. This is patched in version 8.6.3.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 15 SP6-LTSS:redis-7.2.4-150600.3.24.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:redis-7.2.4-150600.3.24.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:redis-7.2.4-150600.3.24.1.s390x",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:redis-7.2.4-150600.3.24.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:redis-7.2.4-150600.3.24.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP6:redis-7.2.4-150600.3.24.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP6:redis-7.2.4-150600.3.24.1.s390x",
          "SUSE Linux Enterprise Server 15 SP6:redis-7.2.4-150600.3.24.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:redis-7.2.4-150600.3.24.1.aarch64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:redis-7.2.4-150600.3.24.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:redis-7.2.4-150600.3.24.1.s390x",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:redis-7.2.4-150600.3.24.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-23631",
          "url": "https://www.suse.com/security/cve/CVE-2026-23631"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1264165 for CVE-2026-23631",
          "url": "https://bugzilla.suse.com/1264165"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 15 SP6-LTSS:redis-7.2.4-150600.3.24.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:redis-7.2.4-150600.3.24.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:redis-7.2.4-150600.3.24.1.s390x",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:redis-7.2.4-150600.3.24.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:redis-7.2.4-150600.3.24.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP6:redis-7.2.4-150600.3.24.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP6:redis-7.2.4-150600.3.24.1.s390x",
            "SUSE Linux Enterprise Server 15 SP6:redis-7.2.4-150600.3.24.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:redis-7.2.4-150600.3.24.1.aarch64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:redis-7.2.4-150600.3.24.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:redis-7.2.4-150600.3.24.1.s390x",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:redis-7.2.4-150600.3.24.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 15 SP6-LTSS:redis-7.2.4-150600.3.24.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:redis-7.2.4-150600.3.24.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:redis-7.2.4-150600.3.24.1.s390x",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:redis-7.2.4-150600.3.24.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:redis-7.2.4-150600.3.24.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP6:redis-7.2.4-150600.3.24.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP6:redis-7.2.4-150600.3.24.1.s390x",
            "SUSE Linux Enterprise Server 15 SP6:redis-7.2.4-150600.3.24.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:redis-7.2.4-150600.3.24.1.aarch64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:redis-7.2.4-150600.3.24.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:redis-7.2.4-150600.3.24.1.s390x",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:redis-7.2.4-150600.3.24.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-27T14:21:52Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-23631"
    },
    {
      "cve": "CVE-2026-25243",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-25243"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This is patched in version 8.6.3.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 15 SP6-LTSS:redis-7.2.4-150600.3.24.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:redis-7.2.4-150600.3.24.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:redis-7.2.4-150600.3.24.1.s390x",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:redis-7.2.4-150600.3.24.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:redis-7.2.4-150600.3.24.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP6:redis-7.2.4-150600.3.24.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP6:redis-7.2.4-150600.3.24.1.s390x",
          "SUSE Linux Enterprise Server 15 SP6:redis-7.2.4-150600.3.24.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:redis-7.2.4-150600.3.24.1.aarch64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:redis-7.2.4-150600.3.24.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:redis-7.2.4-150600.3.24.1.s390x",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:redis-7.2.4-150600.3.24.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-25243",
          "url": "https://www.suse.com/security/cve/CVE-2026-25243"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1264166 for CVE-2026-25243",
          "url": "https://bugzilla.suse.com/1264166"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1273162 for CVE-2026-25243",
          "url": "https://bugzilla.suse.com/1273162"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 15 SP6-LTSS:redis-7.2.4-150600.3.24.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:redis-7.2.4-150600.3.24.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:redis-7.2.4-150600.3.24.1.s390x",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:redis-7.2.4-150600.3.24.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:redis-7.2.4-150600.3.24.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP6:redis-7.2.4-150600.3.24.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP6:redis-7.2.4-150600.3.24.1.s390x",
            "SUSE Linux Enterprise Server 15 SP6:redis-7.2.4-150600.3.24.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:redis-7.2.4-150600.3.24.1.aarch64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:redis-7.2.4-150600.3.24.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:redis-7.2.4-150600.3.24.1.s390x",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:redis-7.2.4-150600.3.24.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 15 SP6-LTSS:redis-7.2.4-150600.3.24.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:redis-7.2.4-150600.3.24.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:redis-7.2.4-150600.3.24.1.s390x",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:redis-7.2.4-150600.3.24.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:redis-7.2.4-150600.3.24.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP6:redis-7.2.4-150600.3.24.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP6:redis-7.2.4-150600.3.24.1.s390x",
            "SUSE Linux Enterprise Server 15 SP6:redis-7.2.4-150600.3.24.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:redis-7.2.4-150600.3.24.1.aarch64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:redis-7.2.4-150600.3.24.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:redis-7.2.4-150600.3.24.1.s390x",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:redis-7.2.4-150600.3.24.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-27T14:21:52Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-25243"
    }
  ]
}

CVE-2026-23479 (GCVE-0-2026-23479)

Vulnerability from cvelistv5 – Published: 2026-05-05 16:36 – Updated: 2026-07-16 12:04

Title

redis-server use-after-free in unblock client flow may allow remote code execution

Summary

Redis is an in-memory data structure store. In redis-server from 7.2.0 until 8.6.3, the unblock client flow does not handle an error return from `processCommandAndResetClient` when re-executing a blocked command. If a blocked client is evicted during this flow, an authenticated attacker can trigger a use-after-free that may lead to remote code execution. This has been patched in version 8.6.3.

Severity

7.7 (High)


                        
                          CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-05 00:00 UTC

CWE

CWE-416 - Use After Free

Assigner

GitHub_M mitre root Scorecard

References

12 references

URL	Tags
https://github.com/redis/redis/security/advisorie…	x_refsource_CONFIRM
https://github.com/redis/redis/releases/tag/8.6.3	x_refsource_MISC
https://access.redhat.com/security/cve/CVE-2026-23479	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2466780	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:26540	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:25216	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26306	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:25219	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:25925	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7662	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:14316	vendor-advisoryx_refsource_REDHAT

Impacted products

10 products

Vendor	Product	Version
redis	redis	Affected: >= 7.2.0, < 8.6.3
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:8.0.9-1.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:8.0.9-1.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 9080020260521083756.9 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:8.0.9-1.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 9060020260602115714.9 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat Hardened Images	Unaffected: 9.0.4-0.1.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Hardened Images	Unaffected: 1.90.0-7.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-23479",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-05T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-06T03:56:08.169Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "valkey",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:8.0.9-1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "valkey",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:8.0.9-1.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "redis:7",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "9080020260521083756.9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "valkey",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:8.0.9-1.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "redis:7",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "9060020260602115714.9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "valkey-main",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "9.0.4-0.1.hum1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "boost-main",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1.90.0-7.hum1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "redis:6/redis",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "redis",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-05-05T16:36:05.486Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in Redis. The unblock client flow does not handle an error return from the `processCommandAndResetClient` when re-executing a blocked command. If a blocked client is evicted during this flow, an authenticated attacker can cause a use-after-free issue. This potentially leads to arbitrary code execution."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-16T12:04:42.049Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-23479"
          },
          {
            "name": "RHBZ#2466780",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466780"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23479.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:26540"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:25216"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:26306"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:25219"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:25925"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:7662"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:14316"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:26540: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:25216: Red Hat Enterprise Linux AppStream (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:26306: Red Hat Enterprise Linux AppStream EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:25219: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:25925: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:7662: Red Hat Hardened Images"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:14316: Red Hat Hardened Images"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-05-05T17:01:54.051Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-05-05T16:36:05.486Z",
            "value": "Made public."
          }
        ],
        "title": "redis: use-after-free in unblock client flow may allow remote code execution",
        "workarounds": [
          {
            "lang": "en",
            "value": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "redis",
          "vendor": "redis",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 7.2.0, \u003c 8.6.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Redis is an in-memory data structure store. In redis-server from 7.2.0 until 8.6.3, the unblock client flow does not handle an error return from `processCommandAndResetClient` when re-executing a blocked command. If a blocked client is evicted during this flow, an authenticated attacker can trigger a use-after-free that may lead to remote code execution. This has been patched in version 8.6.3."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "CWE-416: Use After Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-05T16:41:47.303Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/redis/redis/security/advisories/GHSA-93m2-935m-8rj3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/redis/redis/security/advisories/GHSA-93m2-935m-8rj3"
        },
        {
          "name": "https://github.com/redis/redis/releases/tag/8.6.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/redis/redis/releases/tag/8.6.3"
        }
      ],
      "source": {
        "advisory": "GHSA-93m2-935m-8rj3",
        "discovery": "UNKNOWN"
      },
      "title": "redis-server use-after-free in unblock client flow may allow remote code execution"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-23479",
    "datePublished": "2026-05-05T16:36:05.486Z",
    "dateReserved": "2026-01-13T15:47:41.627Z",
    "dateUpdated": "2026-07-16T12:04:42.049Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-23631 (GCVE-0-2026-23631)

Vulnerability from cvelistv5 – Published: 2026-05-05 16:39 – Updated: 2026-07-16 12:04

Title

redis-server Lua use-after-free may allow remote code execution

Summary

Redis is an in-memory data structure store. In all versions of redis-server with Lua scripting, an authenticated attacker can exploit the master-replica synchronization mechanism to trigger a use-after-free on replicas where replica-read-only is disabled or can be disabled, which may lead to remote code execution. A workaround is to prevent users from executing Lua scripts or avoid using replicas where replica-read-only is disabled. This is patched in version 8.6.3.

Severity

6.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-06 03:56 UTC

CWE

CWE-416 - Use After Free

Assigner

GitHub_M mitre root Scorecard

References

12 references

URL	Tags
https://github.com/redis/redis/security/advisorie…	x_refsource_CONFIRM
https://github.com/redis/redis/releases/tag/8.6.3	x_refsource_MISC
https://access.redhat.com/security/cve/CVE-2026-23631	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2466788	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:26540	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:25216	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33444	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26306	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:25219	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:25925	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:14316	vendor-advisoryx_refsource_REDHAT

Impacted products

11 products

Vendor	Product	Version
redis	redis	Affected: < 8.6.3
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:8.0.9-1.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:8.0.9-1.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 9080020260521083756.9 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:8.0.9-1.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	Unaffected: 9040020260625094332.9 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.4
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 9060020260602115714.9 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat Hardened Images	Unaffected: 9.0.4-0.1.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Hardened Images	cpe:/a:redhat:hummingbird:1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-23631",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-06T03:56:10.112246Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-06T13:23:48.308Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "valkey",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:8.0.9-1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "valkey",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:8.0.9-1.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "redis:7",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "9080020260521083756.9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "valkey",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:8.0.9-1.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "redis:7",
            "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "9040020260625094332.9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "redis:7",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "9060020260602115714.9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "valkey-main",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "9.0.4-0.1.hum1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unknown",
            "packageName": "redis:6/redis",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unknown",
            "packageName": "redis",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "boost",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-05-05T16:39:32.337Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in Redis, an in-memory data structure store. An authenticated attacker can exploit a use-after-free vulnerability in redis-server with Lua scripting. This occurs through the master-replica synchronization mechanism on replicas where replica-read-only is disabled or can be disabled. Successful exploitation may lead to remote code execution."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-16T12:04:50.140Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-23631"
          },
          {
            "name": "RHBZ#2466788",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466788"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23631.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:26540"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:25216"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33444"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:26306"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:25219"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:25925"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:14316"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:26540: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:25216: Red Hat Enterprise Linux AppStream (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33444: Red Hat Enterprise Linux AppStream E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:26306: Red Hat Enterprise Linux AppStream EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:25219: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:25925: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:14316: Red Hat Hardened Images"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-05-05T17:02:23.286Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-05-05T16:39:32.337Z",
            "value": "Made public."
          }
        ],
        "title": "redis: Remote code execution via use-after-free in Lua scripting",
        "workarounds": [
          {
            "lang": "en",
            "value": "To mitigate this flaw, ensure that Redis replicas maintain `replica-read-only` as enabled and prevent its modification by unauthorized users. If Lua scripting is not a required feature, consider disabling it to reduce the attack surface. Restricting network access to Redis instances to trusted clients can also limit exposure.\nFor Redis configuration, edit the `redis.conf` file to include or verify:\n`replica-read-only yes`\nAfter modifying the configuration, restart the Redis service for the changes to take effect. This action will temporarily interrupt service availability."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "redis",
          "vendor": "redis",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 8.6.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Redis is an in-memory data structure store. In all versions of redis-server with Lua scripting, an authenticated attacker can exploit the master-replica synchronization mechanism to trigger a use-after-free on replicas where replica-read-only is disabled or can be disabled, which may lead to remote code execution. A workaround is to prevent users from executing Lua scripts or avoid using replicas where replica-read-only is disabled. This is patched in version 8.6.3."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "CWE-416: Use After Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-05T16:39:32.337Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/redis/redis/security/advisories/GHSA-8ghh-qpmp-7826",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/redis/redis/security/advisories/GHSA-8ghh-qpmp-7826"
        },
        {
          "name": "https://github.com/redis/redis/releases/tag/8.6.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/redis/redis/releases/tag/8.6.3"
        }
      ],
      "source": {
        "advisory": "GHSA-8ghh-qpmp-7826",
        "discovery": "UNKNOWN"
      },
      "title": "redis-server Lua use-after-free may allow remote code execution"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-23631",
    "datePublished": "2026-05-05T16:39:32.337Z",
    "dateReserved": "2026-01-14T16:08:37.482Z",
    "dateUpdated": "2026-07-16T12:04:50.140Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-25243 (GCVE-0-2026-25243)

Vulnerability from cvelistv5 – Published: 2026-05-05 16:44 – Updated: 2026-07-16 12:04

Title

redis-server RESTORE invalid memory access may allow remote code execution

Summary

Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This is patched in version 8.6.3.

Severity

7.7 (High)


                        
                          CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-06 03:56 UTC

CWE

CWE-122 - Heap-based Buffer Overflow

Assigner

GitHub_M mitre root Scorecard

References

20 references

URL	Tags
https://github.com/redis/redis/security/advisorie…	x_refsource_CONFIRM
https://github.com/redis/redis/releases/tag/8.6.3	x_refsource_MISC
https://access.redhat.com/security/cve/CVE-2026-25243	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2466828	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:26540	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:25216	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26008	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:27787	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:29817	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33427	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:27716	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:28139	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:28142	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26233	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26306	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:23229	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:25219	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:25925	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:14316	vendor-advisoryx_refsource_REDHAT

Impacted products

20 products

Vendor	Product	Version
redis	redis	Affected: < 8.6.3
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:8.0.9-1.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:8.0.9-1.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 8100020260522105353.489197e6 , < * (rpm) cpe:/a:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	Unaffected: 8040020260618162855.522a0ee4 , < * (rpm) cpe:/a:redhat:rhel_aus:8.4
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	Unaffected: 8040020260618162855.522a0ee4 , < * (rpm) cpe:/a:redhat:rhel_eus_long_life:8.4
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 8060020260623095617.ad008a3a , < * (rpm) cpe:/a:redhat:rhel_aus:8.6
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On	Unaffected: 8060020260623095617.ad008a3a , < * (rpm) cpe:/a:redhat:rhel_eus_long_life:8.6
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	Unaffected: 8080020260626132343.63b34585 , < * (rpm) cpe:/a:redhat:rhel_tus:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	Unaffected: 8080020260626132343.63b34585 , < * (rpm) cpe:/a:redhat:rhel_e4s:8.8
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:6.2.22-1.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 9080020260521083756.9 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:8.0.9-1.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:6.2.7-1.el9_2.6 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	Unaffected: 0:6.2.7-1.el9_4.6 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.4
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	Unaffected: 9040020260618054637.9 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.4
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:6.2.22-1.el9_6 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 9060020260602115714.9 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat Hardened Images	Unaffected: 9.0.4-0.1.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Hardened Images	cpe:/a:redhat:hummingbird:1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-25243",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-06T03:56:11.272472Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-06T13:24:39.678Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "valkey",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:8.0.9-1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "valkey",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:8.0.9-1.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "redis:6",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8100020260522105353.489197e6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_aus:8.4"
            ],
            "defaultStatus": "affected",
            "packageName": "redis:6",
            "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8040020260618162855.522a0ee4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus_long_life:8.4"
            ],
            "defaultStatus": "affected",
            "packageName": "redis:6",
            "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8040020260618162855.522a0ee4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_aus:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "redis:6",
            "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8060020260623095617.ad008a3a",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus_long_life:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "redis:6",
            "product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8060020260623095617.ad008a3a",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_tus:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "redis:6",
            "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8080020260626132343.63b34585",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "redis:6",
            "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8080020260626132343.63b34585",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "redis",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.2.22-1.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "redis:7",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "9080020260521083756.9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "valkey",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:8.0.9-1.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2"
            ],
            "defaultStatus": "affected",
            "packageName": "redis",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.2.7-1.el9_2.6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "redis",
            "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.2.7-1.el9_4.6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "redis:7",
            "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "9040020260618054637.9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "redis",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.2.22-1.el9_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "redis:7",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "9060020260602115714.9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "valkey-main",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "9.0.4-0.1.hum1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "boost",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-05-05T16:44:57.306Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in Redis. An authenticated attacker with permission to execute the RESTORE command can send a crafted serialized payload that may lead to an invalid memory access due to an improper validation of the serialized values. This flaw can cause the server to crash and may allow arbitrary code execution."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-122",
                "description": "Heap-based Buffer Overflow",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-16T12:04:33.393Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-25243"
          },
          {
            "name": "RHBZ#2466828",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466828"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25243.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:26540"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:25216"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:26008"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:27787"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:29817"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33427"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:27716"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:28139"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:28142"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:26233"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:26306"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:23229"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:25219"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:25925"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:14316"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:26540: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:25216: Red Hat Enterprise Linux AppStream (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:26008: Red Hat Enterprise Linux AppStream (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:27787: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:29817: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33427: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:27716: Red Hat Enterprise Linux AppStream E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:28139: Red Hat Enterprise Linux AppStream E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:28142: Red Hat Enterprise Linux AppStream E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:26233: Red Hat Enterprise Linux AppStream EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:26306: Red Hat Enterprise Linux AppStream EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:23229: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:25219: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:25925: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:14316: Red Hat Hardened Images"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-05-05T18:01:12.034Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-05-05T16:44:57.306Z",
            "value": "Made public."
          }
        ],
        "title": "redis: RESTORE invalid memory access may allow remote code execution",
        "workarounds": [
          {
            "lang": "en",
            "value": "To mitigate this flaw, restrict the execution privileges of the RESTORE command exclusively to highly trusted and administrative users by using the appropriate ACL rules."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "redis",
          "vendor": "redis",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 8.6.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This is patched in version 8.6.3."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "CWE-122: Heap-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-05T16:44:57.306Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/redis/redis/security/advisories/GHSA-c8h9-259x-jff4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/redis/redis/security/advisories/GHSA-c8h9-259x-jff4"
        },
        {
          "name": "https://github.com/redis/redis/releases/tag/8.6.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/redis/redis/releases/tag/8.6.3"
        }
      ],
      "source": {
        "advisory": "GHSA-c8h9-259x-jff4",
        "discovery": "UNKNOWN"
      },
      "title": "redis-server RESTORE invalid memory access may allow remote code execution"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-25243",
    "datePublished": "2026-05-05T16:44:57.306Z",
    "dateReserved": "2026-01-30T14:44:47.330Z",
    "dateUpdated": "2026-07-16T12:04:33.393Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

SUSE-SU-2026:2099-1

CVE-2026-23479 (GCVE-0-2026-23479)

CVE-2026-23631 (GCVE-0-2026-23631)

CVE-2026-25243 (GCVE-0-2026-25243)

Tags

Sightings

Nomenclature

Related by attack behaviour