Is CVE-2026-23631 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-23631 being exploited in the wild.

How severe is CVE-2026-23631?

High severity, with a CVSS score of 8.1, published 5 May 2026.

Which products and versions are affected?

Red Hat Enterprise Linux AppStream 9, 10.

Is there a fix for CVE-2026-23631?

A patch was published on 2026-05-05: Redis version 8.6.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-23631 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-23631?

Check whether you run Red Hat Enterprise Linux AppStream at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-23631: Redis use-after-free in Lua scripting synchronization

CVE-2026-23631 · Severity: high · CVSS 8.1 · Published 2026-05-05

Redis is a widely used in-memory data store for caching and real-time data processing. A security vulnerability has been identified where an authenticated user can exploit the way data is synchronized between primary and replica servers. If successful, this could allow an attacker to execute unauthorized code on the replica servers, potentially leading to a full system compromise or service disruption.

Technologies: Red Hat Enterprise Linux AppStream. Vendors: Red Hat.

Quick answers

Is CVE-2026-23631 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-23631 being exploited in the wild.
How severe is CVE-2026-23631?: High severity, with a CVSS score of 8.1, published 5 May 2026.
Which products and versions are affected?: Red Hat Enterprise Linux AppStream 9, 10.
Is there a fix for CVE-2026-23631?: A patch was published on 2026-05-05: Redis version 8.6.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-23631 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-23631?: Check whether you run Red Hat Enterprise Linux AppStream at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A use-after-free (UAF) vulnerability exists in Redis-server's Lua scripting engine during master-replica synchronization. An authenticated attacker with low privileges can exploit the synchronization mechanism to trigger the UAF on replica nodes, provided that the 'replica-read-only' configuration is disabled or can be toggled. This memory corruption flaw can be leveraged to achieve remote code execution (RCE) on the affected replica. The issue is addressed in Redis version 8.6.3. Workarounds include disabling Lua scripting for users or ensuring 'replica-read-only' remains enabled on all replicas.

Affected products

Redis Redis All versions with Lua scripting prior to 8.6.3
Red Hat Red Hat Enterprise Linux AppStream 9, 10
Red Hat Valkey RHEL 10

Timeline

2026-05-05: disclosed
2026-05-05: patched: Redis version 8.6.3 released
2026-06-11: advisory: Red Hat issued RHSA-2026:25216 for Valkey/RHEL

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.