Vulnerability intelligence

CVE-2026-23479

Redis is an in-memory data structure store. In redis-server from 7.2.0 until 8.6.3, the unblock client flow does not handle an error return from `processCommandAndResetClient` when re-executing a blocked command. If a blocked client is evicted during this flow, an authenticated attacker can trigger a use-after-free that may lead to remote code execution. This has been patched in version 8.6.3.

CVSS Score

7.7

High

EPSS — Exploit Probability

1.4%

Riskier than 70% of all CVEs · checked 2026-09-09

Exploitation

Not in CISA KEV

KEV does not include every exploited vulnerability

Remediation

Patch available

Vendor fix published