Do Son 
TL;DR
Researchers published proof-of-concept exploit code for a Redis RCE vulnerability. The heap use-after-free lets a remote user run system commands as the Redis server process. Redis fixed the flaw in version 8.8.2.
- Product: redis
- Vulnerabilities: 1 flaw (CVE-2026-23479)
- Highest severity: 7.7 (High · CVSSv4)
- Worst impact: server use-after-free in unblock client flow may allow remote code execution
- Status: No confirmed exploitation yet
- Action: See vendor advisories
| CVE | CVSS (CVSSv4) | Type | Fixed in | Status |
|---|---|---|---|---|
| CVE-2026-23479 | 7.7 | server use-after-free in unblock client flow may allow remote code execution | — | Not exploited |
Why it matters
Redis powers caching and messaging for countless apps. A single compromised server can expose application data, session tokens, and internal network access. This Redis RCE vulnerability turns normal commands into full server takeover.
Rick de Jager of the V12 security team found the bug. It is a still-reachable sibling variant of the earlier CVE-2026-23479. The upstream fix for that flaw protected only the executing client, not a different blocked client freed mid-iteration.
How the attack works
The flaw is a heap use-after-free in Redis’s blocked-client handling. Re-executing one blocked client’s command can free a sibling client still on the list. The next loop step then reads reclaimed memory as a live client.
From there, the researcher chains heap grooming and pointer reads into arbitrary command execution. The exploit uses only the normal TCP command interface. It needs no module loading, file write, or server restart.
The published write-up confirms a working chain. It even works with full RELRO hardening in place. The account notes the exploit needs rights to run commands like CONFIG SET. So far, no exploitation in the wild has been confirmed.
Affected versions
The lab targets Redis 8.8.0. The related parent flaw, CVE-2026-23479, reached back to Redis 7.2.0. The 8.8.2 release also patches CVE-2026-62356, a separate memory-corruption bug.
Patch and mitigation
Update now. The fix ships in the Redis 8.8.2 release. The full technical details and public proof-of-concept exploit code are already disclosed on GitHub.
If you cannot patch at once, restrict access. Keep Redis off the public internet and bind it to private networks. Enforce authentication and trim risky privileges like CONFIG and scripting from shared users.
Support Our Threat Intelligence
Find our zero-day alerts and CVE reports helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
PayPal
