Redis · Redis-Server · CVE-2026-23479
**Name of the Vulnerable Software and Affected Versions**
redis-server versions 7.2.0 through 8.6.2
**Description**
A use-after-free issue exists in the unblock client flow of the in-memory data structure store. The flaw occurs because the system does not handle an error return from the `processCommandAndResetClient()` function when re-executing a blocked command. If a blocked client is evicted during this process, an authenticated attacker can trigger the use-after-free condition. This can be exploited through a three-stage chain: using a Lua script to leak a heap pointer, grooming client memory to reclaim a freed slot with a fake client structure, and overwriting a function pointer in the Global Offset Table to redirect a string function to `system()`. This allows the attacker to execute arbitrary OS commands on the host server. It is estimated that Redis runs in approximately 75% of cloud environments, many of which operate without passwords, potentially lowering the barrier for authentication.
**Recommendations**
Update redis-server to version 8.6.3.
As a temporary workaround, disable Lua scripting entirely to break the first stage of the exploit chain.
Restrict Redis access to trusted networks and avoid exposing it directly to the internet.
Tighten Access Control Lists (ACLs) so that no single role possesses both `u/admin` and `u/scripting` permissions simultaneously.