Описание
Redis is an in-memory data structure store. In redis-server from 7.2.0 until 8.6.3, the unblock client flow does not handle an error return from `processCommandAndResetClient` when re-executing a blocked command. If a blocked client is evicted during this flow, an authenticated attacker can trigger a use-after-free that may lead to remote code execution. This has been patched in version 8.6.3.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| redict | unfixed | package | ||
| redis | fixed | 5:8.6.3-1 | experimental | package |
| redis | fixed | 5:8.0.6-3 | package | |
| redis | not-affected | bookworm | package | |
| redis | not-affected | bullseye | package | |
| valkey | fixed | 9.1.1-1 | package |
Примечания
https://github.com/redis/redis/security/advisories/GHSA-93m2-935m-8rj3
https://www.zeroday.cloud/blog/redis-cve-2026-23479-deep-dive
Fixed by: https://github.com/redis/redis/commit/c14e9925e571c3c8ecbeb8632fe834faa32175ea (8.6.3)
valkey is affected as well, unblockClientOnKey() ignores the C_ERR return of
processCommandAndResetClient(); reproduced under ASan on 8.1.1+dfsg1-3+deb13u2.
https://github.com/valkey-io/valkey/pull/3613
valkey fixed by: https://github.com/valkey-io/valkey/commit/1d7224f3894c8e6db39a9e86c040270b3122c064 (8.1.7)
redict 7.3.x is based on redis 7.2.4, so unlike bookworm/bullseye the reprocess-on-unblock
path is present; unblockClientOnKey() calls processCommandAndResetClient() unchecked
EPSS
Связанные уязвимости
Redis is an in-memory data structure store. In redis-server from 7.2.0 until 8.6.3, the unblock client flow does not handle an error return from `processCommandAndResetClient` when re-executing a blocked command. If a blocked client is evicted during this flow, an authenticated attacker can trigger a use-after-free that may lead to remote code execution. This has been patched in version 8.6.3.
Redis is an in-memory data structure store. In redis-server from 7.2.0 until 8.6.3, the unblock client flow does not handle an error return from `processCommandAndResetClient` when re-executing a blocked command. If a blocked client is evicted during this flow, an authenticated attacker can trigger a use-after-free that may lead to remote code execution. This has been patched in version 8.6.3.
Redis is an in-memory data structure store. In redis-server from 7.2.0 until 8.6.3, the unblock client flow does not handle an error return from `processCommandAndResetClient` when re-executing a blocked command. If a blocked client is evicted during this flow, an authenticated attacker can trigger a use-after-free that may lead to remote code execution. This has been patched in version 8.6.3.
redis-server use-after-free in unblock client flow may allow remote code execution
Use-After-Free in unblock client flow may lead to remote code execution
EPSS