HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-23479 — Redis is an in-memory data structure store. In redis-server from 7.2.0 until 8.6...

·Source: NIST NVD

Updated:

Executive Summary

Redis is an in-memory data structure store. In redis-server from 7.2.0 until 8.6.3, the unblock client flow does not handle an error return from `processCommandAndResetClient` when re-executing a blocked command. If a blocked client is evicted during this flow, an authenticated attacker can trigger a use-after-free that may lead to remote code execution. This has been patched in version 8.6.3.

Analysis

Redis is an in-memory data structure store. In redis-server from 7.2.0 until 8.6.3, the unblock client flow does not handle an error return from `processCommandAndResetClient` when re-executing a blocked command. If a blocked client is evicted during this flow, an authenticated attacker can trigger a use-after-free that may lead to remote code execution. This has been patched in version 8.6.3. CVSS Score: 8.8. Published: 2026-05-05T17:17:02.577.

Indicators of Compromise (1)

CVE (1)
CVE-2026-23479
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on May 5, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

Autonomous AI Tool Finds 2-Year-Old RCE Flaw in Redis (CVE-2026-23479)

Redis has patched a use-after-free in its blocking-client code that lets an authenticated user run arbitrary OS commands on the machine hosting the database. The flaw was found by an autonomous AI tool built to hunt bugs in large codebases. Tracked as CVE-2026-23479, the flaw was introduced in Redis 7.2.0 and remained in every stable branch until the May 5 fixes, unnoticed for over two years.

CVE-2026-23479
The Hacker News
CRITICALAi

Patch Tuesday - May 2026

Microsoft is publishing 137 vulnerabilities on May 2026 Patch Tuesday . Microsoft is not aware of exploitation in the wild or public disclosure for any of these vulnerabilities. So far this month, Microsoft has provided patches to address 133 browser vulnerabilities, which are not included in the Patch Tuesday count above. Windows Netlogon: critical RCE Anyone responsible for securing a domain con

CVE-2026-41089CVE-2020-1472
Rapid7
LOWVulnerabilityNEW

CIOs and HR Leaders Must Redesign Work for AI

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/cios-hr-leaders-must-redesign-work-for-ai-image_small-4-a-33254.jpg" align=right hspace=4><b>Survey: Organizations Must Clarify Accountability as Leadership Roles Shift</b><br>AI is changing how work is divided and decisions are made, while many organizations still haven't clarified who owns AI-related choices and outcomes. CIOs c

Bank Info Security