# CVE-2023-28858: redis-py race condition in async command handling

Source: https://junglewise.ai/threats/cve-2023-28858-redis-py-race-condition-in-async-command-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-03-26. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2023-28858 · Severity: low · CVSS 3.1 · Published 2023-03-26

redis-py is a widely-used Python library for interacting with Redis, a popular in-memory data store used in applications like ChatGPT. A race condition in the async command implementation allows connections to enter an unsafe state when commands are cancelled at specific moments, causing response data from one request to be misrouted to unrelated subsequent requests. This can lead to data leakage between application instances sharing a connection.

Technologies: [redis (PyPI)](https://junglewise.ai/threats/technologies/pypi-redis). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi), [Redis](https://junglewise.ai/threats/vendors/redis).

## Quick answers

**Is CVE-2023-28858 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-28858 being exploited in the wild.

**How severe is CVE-2023-28858?** Low severity, with a CVSS score of 3.1, published 26 March 2023.

**Which products and versions are affected?** redis (PyPI) ECOSYSTEM:introduced=4.2.0,fixed=4.3.6,introduced=4.4.0,fixed=4.4.3,introduced=4.5.0,fixed=4.5.3; Redis-Py 4.2.0 through 4.3.5; 4.4.0 through 4.4.2; 4.5.0 through 4.5.2.

**Is there a fix for CVE-2023-28858?** Yes. redis (PyPI): upgrade to 4.5.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-28858 attacked?** It is attacked over the network.

**Am I affected by CVE-2023-28858?** Check whether you run redis (PyPI) or Redis-Py at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- redis (PyPI): upgrade to 4.5.3 or later

  ```sh
  pip install "redis>=4.5.3"
  ```


## Technical details

The vulnerability is an off-by-one race condition (CWE-193) in redis-py's async command handler. When an async Redis command is cancelled after being sent but before its response is fully received and parsed, the connection is left in an unsafe state. Subsequent commands on the same connection will read the response from the previous cancelled command instead of their own response, causing an off-by-one mismatch between requests and responses. The attack vector is network-based with high timing requirements (AC:H in CVSS 3.1). No authentication is required. An attacker with ability to influence command cancellation timing can cause response data leakage. The vulnerability was patched in versions 4.3.6, 4.4.3, and 4.5.3, though the fixes were incomplete and led to CVE-2023-28859.

## Affected products

- Redis redis-py 4.2.0 through 4.3.5; 4.4.0 through 4.4.2; 4.5.0 through 4.5.2

## Identifiers

- CVE-2023-28858
- GHSA-24wv-mv5m-xv4h
- PYSEC-2023-45

## Timeline

- 2023-03-17: disclosed: Issue reported in redis-py GitHub issue #2624
- 2023-03-26: advisory: GHSA-24wv-mv5m-xv4h and CVE-2023-28858 published
- 2023-03-27: patched: Fixed in versions 4.3.6, 4.4.3, and 4.5.3 (incomplete fixes)

## References

- [https://github.com/redis/redis-py/issues/2624](https://github.com/redis/redis-py/issues/2624)

## Related threats

- [PYSEC-2023-312 - Redis before 6cbea7d allows a replica to cause an assertion failure in a primary server by sending a…](https://junglewise.ai/threats/pysec-2023-312-redis-before-6cbea7d-allows-a-replica-to-cause-an-706884d8)
- [PYSEC-2023-73 - redis-7.0.10 was discovered to contain a segmentation violation.](https://junglewise.ai/threats/pysec-2023-73-redis-7-0-10-was-discovered-to-contain-a-segmentation-464b01b0)
- [redis-py Race Condition due to incomplete fix](https://junglewise.ai/threats/cve-2023-28859-redis-py-race-condition-due-to-incomplete-fix)
- [PYSEC-2022-43162 - Redis v7.0 was discovered to contain a memory leak via the component streamGetEdgeID.](https://junglewise.ai/threats/pysec-2022-43162-redis-v7-0-was-discovered-to-contain-a-memory-leak-via-68366c0a)