Skip to main content

Redis CVE-2026-23631

| EUVDEUVD-2026-27398 MEDIUM
Use After Free (CWE-416)
2026-05-05 GitHub_M
RCE Use After Free Memory Corruption Redis
6.1
CVSS 4.0 · Vendor: GitHub_M
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Authenticate to Redis master
  2. Delivery
    Craft Lua script targeting synchronization
  3. Exploit
    Execute EVAL command on master
  4. Install
    Master replicates script to replica
  5. C2
    Replica-read-only bypass allows write processing
  6. Execute
    Use-after-free triggered during synchronization
  7. Impact
    Memory corruption exploited
  8. Step 8
    Arbitrary code execution as redis-server process

Vulnerability Assessment

Weakness
CWE
CWE-416
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

The vulnerability requires four specific conditions: (1) authenticated access to Redis (PR:L in CVSS confirms authentication requirement - the attacker must be a valid Redis user), (2) permission to execute Lua scripts via EVAL, EVALSHA, or EVAL_RO commands (enforced via Redis ACL), (3) a master-replica replication topology (not applicable to standalone or cluster-only deployments), and (4) replica-read-only disabled on the target replica (non-default configuration that must be explicitly set). Exploitation is NOT possible if all replicas have replica-read-only enabled (default setting), if users lack EVAL permissions, or in standalone deployments without replicas. The high attack complexity (AC:H) indicates additional constraints in reliably triggering the use-after-free, likely related to precise timing during synchronization or specific Lua script patterns required to corrupt the expected memory state.
Impact

CVSS 6.1 with CVSS:4.0/AV:N/AC:H/PR:L indicates network-accessible remote code execution requiring authenticated access and high attack complexity. The high complexity requirement significantly tempers the real-world risk despite the critical impact rating (VI:H/VA:H). The vulnerability requires three specific conditions: (1) Redis configured as a master-replica setup, (2) replica-read-only disabled on the replica, and (3) the attacker to be an authenticated user capable of executing Lua scripts. These constraints substantially reduce the attack surface compared to unauthenticated network RCE. The high attack complexity suggests the exploit requires precise timing or specific environmental conditions related to the synchronization mechanism. No active exploitation has been reported (KEV status unknown), and the vulnerability appears to be discovered through code analysis rather than in-the-wild exploitation. The targeted nature of the prerequisites (requiring both authenticated access and specific replica configuration) suggests this is a medium priority for most deployments but critical for those running multi-node Redis clusters with write-capable replicas.
Exploit ScenarioDerived

An authenticated attacker with permission to execute Lua scripts (common in managed Redis clusters or internal deployments) connects to the Redis master and submits a crafted Lua script designed to trigger memory cleanup on the replica during synchronization. The master propagates the script to a replica where replica-read-only is disabled. During the replication process, the replica's Lua script state is improperly freed while the synchronization handler still holds references to it. When the replica processes a subsequent command (triggering the dangling pointer dereference), the use-after-free is triggered, allowing the attacker to overwrite memory and potentially execute arbitrary code with redis-server privileges. High attack complexity suggests the timing or specific script conditions must be precisely crafted to reliably trigger the vulnerability.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 05, 2026

Redis-server with Lua scripting allows authenticated attackers to trigger a use-after-free vulnerability on replicas where replica-read-only is disabled, potentially leading to remote code execution. The vulnerability exploits the master-replica synchronization mechanism and is present in all versions prior to 8.6.3. Patch vendor-released patch: 8.6.3.

RemediationAI

Immediately upgrade redis-server to version 8.6.3 or later, which includes the fix for CVE-2026-23631. If immediate patching is not feasible, implement one of two workarounds: (1) Disable Lua script execution by setting 'script-flush-on-replicas' appropriately and preventing users from executing EVAL, EVALSHA, or EVAL_RO commands via ACL rules (recommended for non-dependent workloads but may break Lua-dependent applications), or (2) Ensure all replicas have replica-read-only enabled (the default configuration), which eliminates the synchronization pathway that triggers the vulnerability. The second workaround has minimal operational impact if your replica nodes are not intended to accept writes. For upgrades, follow the standard Redis upgrade procedure with slaves restarted first, then the master, to minimize downtime. Verify the fix by checking redis-server version with INFO server command after restart.

Affected VersionsENISA

Redis < 8.6.3

Affected Packages

euvd redis fix: 8.6.3

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Redis Lua scripting integrates a Lua interpreter into the redis-server to allow atomic execution of multi-command sequences. The vulnerability arises in the master-replica synchronization flow where Lua script state is transmitted to replica nodes. When replica-read-only is disabled (allowing write operations on replicas), the synchronization mechanism fails to properly manage memory references to Lua script objects, leaving dangling pointers that can be dereferenced when processing subsequent commands. This is a classic use-after-free (CWE-416) memory corruption issue where freed memory belonging to Lua script state structures is accessed after deallocation, potentially allowing arbitrary code execution with the privileges of the redis-server process.

Know when Redis gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (GitHub_M) PRIMARY 6.1 MEDIUM
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 8.1 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Red Hat 8.8 HIGH

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
High
Attack Requirements
None
Privileges Required
Low
User Interaction
None
Vulnerable system: Confidentiality
None
Vulnerable system: Integrity
High
Vulnerable system: Availability
High
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

Lifecycle Timeline

2
Patch available
May 05, 2026 - 18:02 EUVD
CVSS changed
May 05, 2026 - 17:22 NVD
6.1 (MEDIUM)

DescriptionCVE.org

Redis is an in-memory data structure store. In all versions of redis-server with Lua scripting, an authenticated attacker can exploit the master-replica synchronization mechanism to trigger a use-after-free on replicas where replica-read-only is disabled or can be disabled, which may lead to remote code execution. A workaround is to prevent users from executing Lua scripts or avoid using replicas where replica-read-only is disabled. This is patched in version 8.6.3.

Threat Intelligence Overview

EPSS Score
0.1%
Top 72% exploitable
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact· derived
Medium
Technical Impact
Total

Priority Score

30
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +30
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

More in Redis

View all
CVE-2026-48172 CRITICAL POC
10.0 May 21

Privilege escalation to root in the LiteSpeed User-End cPanel Plugin (versions 2.3 through before 2.4.5) lets attackers

CVE-2025-49844 CRITICAL POC
9.9 Oct 03

UAF in Redis 8.2.1 via crafted Lua scripts by authenticated users. EPSS 12.4%. Patch available.
CVE-2022-0543 CRITICAL POC
10.0 Feb 18

It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific
CVE-2018-11218 CRITICAL POC
9.8 Jun 17

Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10,
CVE-2025-46817 HIGH POC
7.0 Oct 03

Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user

CVE-2015-4335 CRITICAL POC
10.0 Jun 09

Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua bytecode via the eval command.
CVE-2016-8339 CRITICAL POC
9.8 Oct 28

A buffer overflow in Redis 3.2.x prior to 3.2.4 causes arbitrary code execution when a crafted command is sent. Rated cr
CVE-2026-77602 CRITICAL POC
9.9 Sep 23

Authenticated remote code execution in OpenC3 COSMOS (Ruby gem 'openc3' versions 5.1.0 through 7.2.1) lets any logged-in
CVE-2026-27574 CRITICAL POC
9.9 Feb 21

Code injection in OneUptime monitoring via custom JS monitor using vm module. PoC and patch available.
CVE-2026-84372 CRITICAL POC
9.8 Sep 01

RESP protocol command injection in Predis, the popular PHP client for Redis and Valkey, affects versions 3.0.0-RC1 throu
CVE-2021-31649 CRITICAL POC
9.8 Jun 24

In applications using jfinal 4.9.08 and below, there is a deserialization vulnerability when using redis,may be vulnerab
CVE-2020-11981 CRITICAL POC
9.8 Jul 17

An issue was found in Apache Airflow versions 1.10.10 and below. Rated critical severity (CVSS 9.8), this vulnerability

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

References

Advisories & patches
ADVISORY https://seclists.org/oss-sec/2026/q2/804 ADVISORY https://vuldb.com/vuln/361205 REF https://access.redhat.com/errata/RHSA-2026:14316 REF https://access.redhat.com/errata/RHSA-2026:25216 REF https://access.redhat.com/errata/RHSA-2026:25219 REF https://access.redhat.com/errata/RHSA-2026:25925 REF https://access.redhat.com/errata/RHSA-2026:26306 REF https://access.redhat.com/errata/RHSA-2026:26540 REF https://access.redhat.com/errata/RHSA-2026:33444 REF https://access.redhat.com/security/cve/CVE-2026-23631 REF https://bugzilla.redhat.com/show_bug.cgi?id=2466788 REF https://github.com/redis/redis/releases/tag/8.6.3 REF https://github.com/redis/redis/security/advisories/GHSA-8ghh-qpmp-7826 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23631.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy