CVE-2026-23631

redis: Redis is an in-memory data structure store

CVE-2026-23631 is fixed in 8 products on 1 platform, first by RHSA-2026:26540, released May 5, 2026. It is not reported as exploited. Patch Radar priority: High.

High
CVSS
8.8
high
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0309
87th percentile

Redis is an in-memory data structure store. In all versions of redis-server with Lua scripting, an authenticated attacker can exploit the master-replica synchronization mechanism to trigger a use-after-free on replicas where replica-read-only is disabled or can be disabled, which may lead to remote code execution. A workaround is to prevent users from executing Lua scripts or avoid using replicas where replica-read-only is disabled. This is patched in version 8.6.3.

Where it's fixed

ProductFixed inFixReleased
Linux
redis · Debian 12.15 (bookworm) 5:7.0.15-1~deb12u8 DEBIAN-CVE-2026-23631 May 5, 2026
redis · Debian 13.5 (trixie) 5:8.0.2-3+deb13u3 DEBIAN-CVE-2026-23631 May 5, 2026
redis · Debian 14 5:8.0.6-3 DEBIAN-CVE-2026-23631 May 5, 2026
redis · RHEL 9 0:7.2.14-1.module+el9.8.0+24327+41ceb644 RHSA-2026:25219 Jun 24, 2026
redis · almalinux 9 7.2.14-1.module_el9.8.0+258+b8f945d3 ALSA-2026:25219 Jun 11, 2026
redis · ol 9 0:7.2.14-1.0.1.module+el9.8.0+90920+b17784e3 ELSA-2026-25219 Jun 23, 2026
redis · opensuse-leap 16.0 8.10.1-bp160.1.1 OPENSUSE-SU-2026:21612-1 Aug 20, 2026
redis · rocky 9 0:7.2.14-1.module+el9.8.0+40207+e2014501 RLSA-2026:25219 Jun 13, 2026
redis-devel · RHEL 9 0:7.2.14-1.module+el9.8.0+24327+41ceb644 RHSA-2026:25219 Jun 24, 2026
redis-devel · almalinux 9 7.2.14-1.module_el9.8.0+258+b8f945d3 ALSA-2026:25219 Jun 11, 2026
redis-devel · ol 9 0:7.2.14-1.0.1.module+el9.8.0+90920+b17784e3 ELSA-2026-25219 Jun 23, 2026
redis-doc · RHEL 9 0:7.2.14-1.module+el9.8.0+24327+41ceb644 RHSA-2026:25219 Jun 24, 2026
redis-doc · almalinux 9 7.2.14-1.module_el9.8.0+258+b8f945d3 ALSA-2026:25219 Jun 11, 2026
redis-doc · ol 9 0:7.2.14-1.0.1.module+el9.8.0+90920+b17784e3 ELSA-2026-25219 Jun 23, 2026
redis-modules · opensuse-leap 16.0 8.10.1-bp160.1.1 OPENSUSE-SU-2026:21612-1 Aug 20, 2026
valkey · Debian 13.5 (trixie) 8.1.1+dfsg1-3+deb13u3 DEBIAN-CVE-2026-23631 May 5, 2026
valkey · Debian 14 9.1.1-1 DEBIAN-CVE-2026-23631 May 5, 2026
valkey · RHEL 10 8.0.9-1.el10_0 RHSA-2026:26540 May 5, 2026
valkey · RHEL 9 0:8.0.9-1.el9_8 RHSA-2026:25925 Jun 24, 2026
valkey · almalinux 10 8.0.9-1.el10_2 ALSA-2026:25216 Jun 11, 2026
valkey · almalinux 9 8.0.9-1.el9_8 ALSA-2026:25925 Jun 15, 2026
valkey · amzn 2023 9.0.4-1.amzn2023.0.1 ALAS2023-2026-1748 May 25, 2026
valkey · ol 10 0:8.0.9-1.el10_2 ELSA-2026-25216 Jul 16, 2026
valkey · ol 9 0:8.0.9-1.el9_8 ELSA-2026-25925 Jun 24, 2026
valkey · rocky 10 0:8.0.9-1.el10_2 RLSA-2026:25216 Jun 13, 2026
valkey · rocky 9 0:8.0.9-1.el9_8 RLSA-2026:25925 Jun 17, 2026
valkey-debuginfo · amzn 2023 9.0.4-1.amzn2023.0.1 ALAS2023-2026-1748 May 25, 2026
valkey-debugsource · amzn 2023 9.0.4-1.amzn2023.0.1 ALAS2023-2026-1748 May 25, 2026
valkey-devel · RHEL 9 0:8.0.9-1.el9_8 RHSA-2026:25925 Jun 24, 2026
valkey-devel · almalinux 10 8.0.9-1.el10_2 ALSA-2026:25216 Jun 11, 2026
valkey-devel · almalinux 9 8.0.9-1.el9_8 ALSA-2026:25925 Jun 15, 2026
valkey-devel · amzn 2023 9.0.4-1.amzn2023.0.1 ALAS2023-2026-1748 May 25, 2026
valkey-devel · ol 10 0:8.0.9-1.el10_2 ELSA-2026-25216 Jul 16, 2026
valkey-devel · ol 9 0:8.0.9-1.el9_8 ELSA-2026-25925 Jun 24, 2026

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.