Redis is an in-memory data structure store. In redis-server from 7.2.0 until 8.6.3, the unblock client flow does not handle an error return from `processCommandAndResetClient` when re-executing a blocked command. If a blocked client is evicted during this flow, an authenticated attacker can trigger a use-after-free that may lead to remote code execution. This has been patched in version 8.6.3.
CVSS Details
- CVSS 4.0 Base Score: 7.7 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade valkey-develUpgrade redis-develUpgrade valkeyUpgrade redisUpgrade redis-doc | Jun 16, 2026 | Jun 11, 2026 |
| Alpine Linux | — | Upgrade redisUpgrade valkey | May 15, 2026 | May 5, 2026 |
| Amazon_linux_2023 | — | Upgrade valkey-debugsourceUpgrade valkey-debuginfoUpgrade valkey-develUpgrade valkey | May 28, 2026 | May 5, 2026 |
| Redhat_linux | — | Upgrade redis-docUpgrade valkey-debugsourceUpgrade redis-develUpgrade valkey-develUpgrade valkeyUpgrade redis-debugsourceUpgrade redis-debuginfoUpgrade valkey-debuginfoUpgrade redis | Jun 17, 2026 | May 5, 2026 |
| Redislabs Redis | — | Upgrade RedisLabs Redis to version 8.6.3 | May 8, 2026 | May 5, 2026 |
| Rocky_linux | — | Upgrade valkey-develUpgrade redis-debuginfoUpgrade redis-debugsourceUpgrade redisUpgrade valkeyUpgrade redis-develUpgrade valkey-debugsourceUpgrade valkey-debuginfo | Jun 17, 2026 | Jun 13, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jun 29, 2026 | May 5, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub