High severity8.8NVD Advisory· Published May 5, 2026· Updated May 6, 2026
CVE-2026-23479
CVE-2026-23479
Description
Redis is an in-memory data structure store. In redis-server from 7.2.0 until 8.6.3, the unblock client flow does not handle an error return from processCommandAndResetClient when re-executing a blocked command. If a blocked client is evicted during this flow, an authenticated attacker can trigger a use-after-free that may lead to remote code execution. This has been patched in version 8.6.3.
Affected products
2Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
2- github.com/redis/redis/security/advisories/GHSA-93m2-935m-8rj3nvdVendor Advisory
- github.com/redis/redis/releases/tag/8.6.3nvdRelease Notes
News mentions
1- Patch Tuesday - May 2026Rapid7 Blog · May 13, 2026