Redis · Redis-Server · CVE-2026-23479
**Name of the Vulnerable Software and Affected Versions**
redis-server versions 7.2.0 through 8.6.3
**Description**
An authenticated attacker can trigger a use-after-free condition in the unblock client flow when a blocked client is evicted. This occurs because the system does not properly handle an error return from the `processCommandAndResetClient()` function when re-executing a blocked command. Exploitation of this flaw can lead to remote code execution, allowing the attacker to execute arbitrary OS commands on the host machine. The issue is particularly critical in cloud environments where Redis instances may be deployed without passwords, as default user roles often possess the necessary privileges for the attack chain. The exploitation process involves a three-stage chain: leaking a heap pointer via a Lua script, grooming client memory to reclaim a freed slot with a fake client structure, and overwriting a function pointer in the Global Offset Table to redirect execution to `system()`.
**Recommendations**
Update redis-server to version 8.6.3 or the corresponding patched version for your branch: 7.2.14, 7.4.9, 8.2.6, or 8.4.3.
Restrict Redis access to trusted networks and avoid exposing it directly to the internet.
Disable Lua scripting if it is not required to break the exploit chain.
Tighten Access Control Lists (ACLs) to ensure no single role possesses both `u/admin` and `u/scripting` privileges simultaneously.