CVE-2026-23631
Remote Code Execution in Redis via Lua Scripting Use-After-Free
Publication date: 2026-05-05
Last updated on: 2026-05-06
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| redis | redis | to 8.6.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-416 | The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability immediately, you should prevent users from executing Lua scripts or avoid using replicas where replica-read-only is disabled.
Additionally, upgrading to Redis version 8.6.3 or later, where this issue is patched, is recommended.
Can you explain this vulnerability to me?
This vulnerability exists in redis-server versions that support Lua scripting. An authenticated attacker can exploit the master-replica synchronization mechanism to trigger a use-after-free condition on replicas where the replica-read-only setting is disabled or can be disabled. This flaw may lead to remote code execution on the affected replicas.
A use-after-free vulnerability occurs when a program continues to use memory after it has been freed, potentially allowing attackers to execute arbitrary code.
The issue is patched in redis-server version 8.6.3, and a workaround involves preventing users from executing Lua scripts or avoiding the use of replicas with replica-read-only disabled.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify how CVE-2026-23631 affects compliance with common standards and regulations such as GDPR or HIPAA.
How can this vulnerability impact me? :
If exploited, this vulnerability can allow an authenticated attacker to execute arbitrary code remotely on the affected Redis replicas.
This could lead to unauthorized control over the Redis server, potentially compromising data integrity, availability, and confidentiality.
Systems using replicas with replica-read-only disabled are particularly at risk.