CVE-2026-23479: 
Redis vulnerability analysis and mitigation

CVE-2026-23479 is a use-after-free (UAF) vulnerability in Redis server's unblock client flow that may lead to remote code execution. It affects redis-server versions from 7.2.0 up to (but not including) 8.6.3, and was disclosed on May 5, 2026. The vulnerability was discovered by independent researcher Xint Code during the Wiz Zeroday Cloud event and patched in Redis 8.6.3. It carries a CVSS v3.1 base score of 8.8 (High) and a CVSS v4.0 base score of 7.7 (High) (GitHub Advisory, Redis Release).

The root cause is a use-after-free condition (CWE-416) in the unblock client flow of redis-server. Specifically, the code path that re-executes a blocked command via processCommandAndResetClient does not handle the case where that function returns an error value. If a blocked client is evicted during this re-execution flow, the server continues to reference the now-freed client object, creating a use-after-free condition. An authenticated attacker can deliberately trigger client eviction at the right moment during a blocked command's re-execution to exploit this race condition and potentially achieve arbitrary code execution with the privileges of the Redis server process (GitHub Advisory, ZeroDay Cloud Deep Dive).

Successful exploitation allows an authenticated attacker to execute arbitrary code remotely with the privileges of the Redis server process, resulting in full confidentiality, integrity, and availability compromise of the affected system. In cloud and containerized environments where Redis is widely deployed as a shared caching or data store layer, exploitation could enable lateral movement to connected services or data exfiltration of sensitive in-memory data. The vulnerability was noted to have remained undetected for approximately two years (since Redis 7.2.0 was introduced), increasing the potential exposure window for affected deployments (GitHub Advisory, The Hacker News).

As of the time of disclosure, there is no confirmed evidence of in-the-wild exploitation or a publicly available weaponized exploit. The EPSS score is approximately 0.00104 (low probability of near-term exploitation). A GitHub repository (pduggusa/redis-cve-2026-23479-check) and references on Sploitus suggest that detection/check scripts and early-stage exploit code have appeared publicly, but no fully weaponized exploit kit has been confirmed. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No specific threat actor attribution has been reported (Feedly Intelligence, Sploitus).

1. Reconnaissance: Identify Redis server instances running versions 7.2.0 through 8.6.2 using network scanners (e.g., Shodan, Censys, nmap with Redis service detection). Confirm the version via the INFO server command if authentication credentials are available.
2. Authentication: Obtain valid Redis credentials (e.g., via credential stuffing, leaked secrets, or misconfigured ACLs) and authenticate to the target Redis instance using AUTH <password>.
3. Trigger a blocking command: Issue a blocking command (e.g., BLPOP, BRPOP, BZPOPMIN) on a key that does not yet exist, causing the client connection to enter a blocked state awaiting data.
4. Trigger client eviction: While the client is blocked, cause the server to evict the blocked client — for example, by exhausting the maxmemory limit or manipulating client timeout settings, forcing the server to free the blocked client object.
5. Race condition exploitation: Arrange for the blocked command to be re-executed (e.g., by pushing data to the awaited key from another connection) at the precise moment the client is being evicted, so that processCommandAndResetClient is called on the freed client object.
6. Use-after-free trigger: The server references the freed client memory, creating a use-after-free condition. With careful heap manipulation (e.g., heap spray or grooming techniques), an attacker can control the freed memory region to redirect execution flow.
7. Achieve code execution: Leverage the UAF to overwrite function pointers or other control-flow data in the freed client structure, ultimately executing arbitrary shellcode or commands with the privileges of the Redis server process (GitHub Advisory, ZeroDay Cloud Deep Dive).

• Network: Unusual or repeated connections to Redis port (default 6379/tcp) from unexpected source IPs; authenticated sessions issuing blocking commands (BLPOP, BRPOP, BZPOPMIN) followed immediately by data pushes from a second connection in rapid succession.
• Logs: Redis server logs (redis.log) showing repeated client disconnections or evictions coinciding with blocked command re-execution; crash reports or segmentation fault entries in system logs (/var/log/syslog, dmesg) associated with the Redis process.
• Process: Unexpected child processes spawned by the Redis server process (e.g., /bin/sh, bash, curl, wget); Redis process consuming abnormally high memory or crashing and restarting.
• File System: New or modified files in the Redis working directory or /tmp; unexpected cron jobs, SSH authorized keys, or scripts created under the user account running Redis.
• Memory: Core dump files generated by the Redis process, which may indicate exploitation attempts that caused crashes during UAF exploitation (GitHub Advisory, ZeroDay Cloud Deep Dive).

The primary remediation is to upgrade Redis to version 8.6.3 or later, which contains the fix for this vulnerability (Redis Release). If immediate patching is not feasible, restrict network access to Redis instances using firewall rules or network ACLs so that only trusted, authorized clients can connect. Additionally, enforce strong authentication controls (Redis ACLs) to limit which users can issue blocking commands, and monitor for anomalous client eviction patterns. Downstream distributions including SUSE, openSUSE, Fedora (via Valkey), Amazon Linux 2023, Mageia, and Debian have also released updated packages addressing this CVE (SUSE Advisory, Amazon Linux).

The vulnerability attracted notable attention due to its discovery by an autonomous AI security tool during the Wiz Zeroday Cloud event, with The Hacker News and multiple security outlets covering the story under headlines such as "Autonomous AI Tool Finds 2-Year-Old RCE Flaw in Redis" (The Hacker News). Redis published an official security advisory blog post covering CVE-2026-23479 alongside four other CVEs patched in the same release (Redis Blog). The Canadian Centre for Cyber Security (CCCS) issued an advisory (AV26-423), and HKCERT published a security bulletin covering the Redis vulnerabilities (CCCS Advisory). Community discussion on Reddit and Mastodon highlighted the significance of an AI tool uncovering a two-year-old vulnerability, with some practitioners debating the practical exploitability given the authentication requirement (Reddit).