CVE-2026-23631

Redis is an in-memory data structure store. In all versions of redis-server with Lua scripting, an authenticated attacker can exploit the master-replica synchronization mechanism to trigger a use-after-free on replicas where replica-read-only is disabled or can be disabled, which may lead to remote code execution. A workaround is to prevent users from executing Lua scripts or avoid using replicas where replica-read-only is disabled. This is patched in version 8.6.3.

Weakness

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory “belongs” to the code that operates on the new pointer.

Affected Software

Name	Vendor	Start Version	End Version
Redis	Redis	*	8.6.3 (excluding)
Red Hat Enterprise Linux 10	RedHat	valkey-0:8.0.9-1.el10_2	*
Red Hat Enterprise Linux 10.0 Extended Update Support	RedHat	valkey-0:8.0.9-1.el10_0	*
Red Hat Enterprise Linux 9	RedHat	redis:7-9080020260521083756.9	*
Red Hat Enterprise Linux 9	RedHat	valkey-0:8.0.9-1.el9_8	*
Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	RedHat	redis:7-9040020260625094332.9	*
Red Hat Enterprise Linux 9.6 Extended Update Support	RedHat	redis:7-9060020260602115714.9	*
Redis	Ubuntu	esm-apps/xenial	*
Redis	Ubuntu	questing	*

NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-23631
CWE	https://cwe.mitre.org/data/definitions/416.html

Use After Free

Weakness

Affected Software

Potential Mitigations

References