CVE-2026-23631 - Vulnerability Analysis

Overview

Redis all versions with Lua scripting contain a use-after-free caused by the master-replica synchronization mechanism on replicas with replica-read-only disabled, letting authenticated attackers achieve remote code execution.

Severity & Score

Impact

Authenticated attackers can execute arbitrary code remotely on replicas with replica-read-only disabled, potentially compromising the system.

Mitigation

Update to version 8.6.3 or later.

References

• https://github.com/redis/redis/releases/tag/8.6.3
• https://github.com/redis/redis/security/advisories/GHSA-8ghh-qpmp-7826

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner