CVE-2026-23631: RCE in Redis 8.6.3 and Earlier
Platform
redis
Component
redis
Fixed in
8.6.3
This vulnerability affects Redis, an in-memory data structure store, allowing authenticated attackers to trigger a use-after-free condition. The flaw resides in the master-replica synchronization mechanism when Lua scripting is enabled. Versions of Redis prior to 8.6.3 are vulnerable, and a fix is available in version 8.6.3.
Impact and Attack Scenarios
An attacker who can authenticate to a Redis instance and execute Lua scripts can exploit this vulnerability to achieve remote code execution on Redis replicas. The use-after-free condition arises when a replica attempts to process data after the master has already released the corresponding memory. Successful exploitation could allow an attacker to execute arbitrary code on the replica server, potentially gaining control of the system and accessing sensitive data stored within Redis. The blast radius extends to any data accessible by the Redis instance, including cached data, session information, and potentially credentials.
Exploitation Context
The vulnerability was published on 2026-05-05. Severity is pending evaluation. No public proof-of-concept (POC) code has been publicly released at the time of writing. Active exploitation campaigns are not currently known, but the RCE nature of the vulnerability warrants careful monitoring and proactive mitigation.
Threat Intelligence
Exploit Status
EPSS
0.08% (23% percentile)
Affected Software
Weakness Classification (CWE)
Timeline
- Published
- Modified
- EPSS updated
Mitigation and Workarounds
The primary mitigation is to upgrade to Redis version 8.6.3 or later, which contains the fix. If upgrading is not immediately feasible, a workaround involves preventing users from executing Lua scripts or disabling the replica-read-only setting on replicas. Disabling Lua scripting significantly reduces the attack surface. If using replicas is critical, carefully review access controls and ensure that only trusted users can execute Lua scripts. After upgrading, confirm the fix by attempting to execute a Lua script on a replica and verifying that it does not trigger the use-after-free condition.
How to fix
Para mitigar este riesgo, actualice a la versión 8.6.3 o posterior de Redis. Alternativamente, desactive la ejecución de scripts Lua o evite el uso de réplicas donde la opción replica-read-only esté deshabilitada.
Frequently asked questions
What is CVE-2026-23631 — RCE in Redis?
CVE-2026-23631 is a Remote Code Execution vulnerability in Redis versions 0.0.0 through 8.6.3. An authenticated attacker can exploit master-replica synchronization via Lua scripting to trigger a use-after-free condition, potentially leading to RCE.
Am I affected by CVE-2026-23631 in Redis?
If you are running Redis versions 0.0.0 through 8.6.3 and have Lua scripting enabled on your replicas, you are potentially affected. Check your Redis version and configuration immediately.
How do I fix CVE-2026-23631 in Redis?
Upgrade to Redis version 8.6.3 or later. Alternatively, disable Lua script execution or the replica-read-only setting on your Redis replicas as a temporary workaround.
Is CVE-2026-23631 being actively exploited?
No active exploitation campaigns are currently known, but the RCE nature of the vulnerability makes it a high-priority concern. Proactive mitigation is strongly recommended.
Where can I find the official Redis advisory for CVE-2026-23631?
Refer to the official Redis security advisory, which will be published on the Redis website and GitHub repository when available. Monitor the Redis blog and security mailing lists for updates.
Is your project affected?
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Try it now — no account
Upload any manifest (composer.lock, package-lock.json, WordPress plugin list…) or paste your component list. You get a vulnerability report instantly. Uploading a file is just the start: with an account you get continuous monitoring, Slack/email alerts, multi-project and white-label reports.
Drag & drop your dependency file
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...