Junglewise Threat Intelligence

CVE-2026-23631: Redis use-after-free in Lua scripting synchronization

CVE-2026-23631 · Severity: high · CVSS 8.1 · Published 2026-05-05

Technologies: Red Hat Enterprise Linux AppStream. Vendors: Red Hat.

Executive brief

Redis is a widely used in-memory data store for caching and real-time data processing. A security vulnerability has been identified where an authenticated user can exploit the way data is synchronized between primary and replica servers. If successful, this could allow an attacker to execute unauthorized code on the replica servers, potentially leading to a full system compromise or service disruption.

Technical details

A use-after-free (UAF) vulnerability exists in Redis-server's Lua scripting engine during master-replica synchronization. An authenticated attacker with low privileges can exploit the synchronization mechanism to trigger the UAF on replica nodes, provided that the 'replica-read-only' configuration is disabled or can be toggled. This memory corruption flaw can be leveraged to achieve remote code execution (RCE) on the affected replica. The issue is addressed in Redis version 8.6.3. Workarounds include disabling Lua scripting for users or ensuring 'replica-read-only' remains enabled on all replicas.

Affected products

  • Redis Redis All versions with Lua scripting prior to 8.6.3
  • Red Hat Red Hat Enterprise Linux AppStream 9, 10
  • Red Hat Valkey RHEL 10

Timeline

  • 2026-05-05: disclosed
  • 2026-05-05: patched: Redis version 8.6.3 released
  • 2026-06-11: advisory: Red Hat issued RHSA-2026:25216 for Valkey/RHEL

References

Related threats