Описание
Redis is an in-memory data structure store. In all versions of redis-server with Lua scripting, an authenticated attacker can exploit the master-replica synchronization mechanism to trigger a use-after-free on replicas where replica-read-only is disabled or can be disabled, which may lead to remote code execution. A workaround is to prevent users from executing Lua scripts or avoid using replicas where replica-read-only is disabled. This is patched in version 8.6.3.
A flaw was found in Redis, an in-memory data structure store. An authenticated attacker can exploit a use-after-free vulnerability in redis-server with Lua scripting. This occurs through the master-replica synchronization mechanism on replicas where replica-read-only is disabled or can be disabled. Successful exploitation may lead to remote code execution.
Отчет
This Important vulnerability in Redis affects instances configured with Lua scripting and operating as replicas where the replica-read-only setting is disabled or can be modified by an authenticated attacker. Exploitation of a use-after-free flaw during master-replica synchronization could lead to remote code execution. The risk is present in deployments where Redis replicas are configured for write operations or lack sufficient access controls to prevent modification of the replica-read-only setting.
Меры по смягчению последствий
To mitigate this flaw, ensure that Redis replicas maintain replica-read-only as enabled and prevent its modification by unauthorized users. If Lua scripting is not a required feature, consider disabling it to reduce the attack surface. Restricting network access to Redis instances to trusted clients can also limit exposure.
For Redis configuration, edit the redis.conf file to include or verify:
replica-read-only yes
After modifying the configuration, restart the Redis service for the changes to take effect. This action will temporarily interrupt service availability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 8 | redis:6/redis | Under investigation | ||
| Red Hat Enterprise Linux 9 | redis | Under investigation | ||
| Red Hat Hardened Images | boost | Not affected | ||
| Red Hat Hardened Images | valkey | Affected | ||
| Red Hat Enterprise Linux 10 | valkey | Fixed | RHSA-2026:25216 | 11.06.2026 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | valkey | Fixed | RHSA-2026:26540 | 17.06.2026 |
| Red Hat Enterprise Linux 9 | redis | Fixed | RHSA-2026:25219 | 11.06.2026 |
| Red Hat Enterprise Linux 9 | valkey | Fixed | RHSA-2026:25925 | 15.06.2026 |
| Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | redis | Fixed | RHSA-2026:33444 | 30.06.2026 |
| Red Hat Enterprise Linux 9.6 Extended Update Support | redis | Fixed | RHSA-2026:26306 | 16.06.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
8.8 High
CVSS3
Связанные уязвимости
Redis is an in-memory data structure store. In all versions of redis-server with Lua scripting, an authenticated attacker can exploit the master-replica synchronization mechanism to trigger a use-after-free on replicas where replica-read-only is disabled or can be disabled, which may lead to remote code execution. A workaround is to prevent users from executing Lua scripts or avoid using replicas where replica-read-only is disabled. This is patched in version 8.6.3.
Redis is an in-memory data structure store. In all versions of redis-server with Lua scripting, an authenticated attacker can exploit the master-replica synchronization mechanism to trigger a use-after-free on replicas where replica-read-only is disabled or can be disabled, which may lead to remote code execution. A workaround is to prevent users from executing Lua scripts or avoid using replicas where replica-read-only is disabled. This is patched in version 8.6.3.
redis-server Lua use-after-free may allow remote code execution
Redis is an in-memory data structure store. In all versions of redis-s ...
EPSS
8.8 High
CVSS3