Cyber Posture

CVE-2026-23631

High

Published: 05 May 2026

Published
05 May 2026
Modified
06 May 2026
KEV Added
—
Patch
—
CVSS Score 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
EPSS Score 0.0010 27.8th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Redis is an in-memory data structure store. In all versions of redis-server with Lua scripting, an authenticated attacker can exploit the master-replica synchronization mechanism to trigger a use-after-free on replicas where replica-read-only is disabled or can be disabled, which may…

more

lead to remote code execution. A workaround is to prevent users from executing Lua scripts or avoid using replicas where replica-read-only is disabled. This is patched in version 8.6.3.

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SI-16 Memory Protection
addresses: CWE-416

Use-after-free exploits that achieve arbitrary code execution are blocked or significantly hardened by non-executable pages and ASLR.

Security SummaryAI

Automated synthesis unavailable for this CVE.

Details

CWE(s)
CWE-416

Affected Products

redis
redis
≤ 8.6.3

References