# CVE-2026-23479: redis: Redis is an in-memory data structure store CVE-2026-23479 is fixed in 8 products on 1 platform, first by RHSA-2026:26540, released May 5, 2026. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2026-23479 - Priority: High - CVSS: 8.8 (high) - EPSS: 0.0261 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: May 5, 2026 ## Description Redis is an in-memory data structure store. In redis-server from 7.2.0 until 8.6.3, the unblock client flow does not handle an error return from `processCommandAndResetClient` when re-executing a blocked command. If a blocked client is evicted during this flow, an authenticated attacker can trigger a use-after-free that may lead to remote code execution. This has been patched in version 8.6.3. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | redis Debian 13.5 (trixie) | 5:8.0.2-3+deb13u3 | [DEBIAN-CVE-2026-23479](https://patchblox.com/security/data/fix/linux/debian-cve-2026-23479.md) | May 5, 2026 | | Linux | redis Debian 14 | 5:8.0.6-3 | [DEBIAN-CVE-2026-23479](https://patchblox.com/security/data/fix/linux/debian-cve-2026-23479.md) | May 5, 2026 | | Linux | redis RHEL 9 | 0:7.2.14-1.module+el9.8.0+24327+41ceb644 | [RHSA-2026:25219](https://patchblox.com/security/data/fix/linux/rhsa-2026-25219.md) | Jun 24, 2026 | | Linux | redis almalinux 9 | 7.2.14-1.module_el9.8.0+258+b8f945d3 | [ALSA-2026:25219](https://patchblox.com/security/data/fix/linux/alsa-2026-25219.md) | Jun 11, 2026 | | Linux | redis ol 9 | 0:7.2.14-1.0.1.module+el9.8.0+90920+b17784e3 | [ELSA-2026-25219](https://patchblox.com/security/data/fix/linux/elsa-2026-25219.md) | Jun 23, 2026 | | Linux | redis opensuse-leap 16.0 | 8.10.1-bp160.1.1 | [OPENSUSE-SU-2026:21612-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21612-1.md) | Aug 20, 2026 | | Linux | redis rocky 9 | 0:7.2.14-1.module+el9.8.0+40207+e2014501 | [RLSA-2026:25219](https://patchblox.com/security/data/fix/linux/rlsa-2026-25219.md) | Jun 13, 2026 | | Linux | redis-devel RHEL 9 | 0:7.2.14-1.module+el9.8.0+24327+41ceb644 | [RHSA-2026:25219](https://patchblox.com/security/data/fix/linux/rhsa-2026-25219.md) | Jun 24, 2026 | | Linux | redis-devel almalinux 9 | 7.2.14-1.module_el9.8.0+258+b8f945d3 | [ALSA-2026:25219](https://patchblox.com/security/data/fix/linux/alsa-2026-25219.md) | Jun 11, 2026 | | Linux | redis-devel ol 9 | 0:7.2.14-1.0.1.module+el9.8.0+90920+b17784e3 | [ELSA-2026-25219](https://patchblox.com/security/data/fix/linux/elsa-2026-25219.md) | Jun 23, 2026 | | Linux | redis-doc RHEL 9 | 0:7.2.14-1.module+el9.8.0+24327+41ceb644 | [RHSA-2026:25219](https://patchblox.com/security/data/fix/linux/rhsa-2026-25219.md) | Jun 24, 2026 | | Linux | redis-doc almalinux 9 | 7.2.14-1.module_el9.8.0+258+b8f945d3 | [ALSA-2026:25219](https://patchblox.com/security/data/fix/linux/alsa-2026-25219.md) | Jun 11, 2026 | | Linux | redis-doc ol 9 | 0:7.2.14-1.0.1.module+el9.8.0+90920+b17784e3 | [ELSA-2026-25219](https://patchblox.com/security/data/fix/linux/elsa-2026-25219.md) | Jun 23, 2026 | | Linux | redis-modules opensuse-leap 16.0 | 8.10.1-bp160.1.1 | [OPENSUSE-SU-2026:21612-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21612-1.md) | Aug 20, 2026 | | Linux | valkey Debian 13.5 (trixie) | 8.1.1+dfsg1-3+deb13u3 | [DEBIAN-CVE-2026-23479](https://patchblox.com/security/data/fix/linux/debian-cve-2026-23479.md) | May 5, 2026 | | Linux | valkey Debian 14 | 9.1.1-1 | [DEBIAN-CVE-2026-23479](https://patchblox.com/security/data/fix/linux/debian-cve-2026-23479.md) | May 5, 2026 | | Linux | valkey RHEL 10 | 8.0.9-1.el10_0 | [RHSA-2026:26540](https://patchblox.com/security/data/fix/linux/rhsa-2026-26540.md) | May 5, 2026 | | Linux | valkey RHEL 9 | 0:8.0.9-1.el9_8 | [RHSA-2026:25925](https://patchblox.com/security/data/fix/linux/rhsa-2026-25925.md) | Jun 24, 2026 | | Linux | valkey almalinux 10 | 8.0.9-1.el10_2 | [ALSA-2026:25216](https://patchblox.com/security/data/fix/linux/alsa-2026-25216.md) | Jun 11, 2026 | | Linux | valkey almalinux 9 | 8.0.9-1.el9_8 | [ALSA-2026:25925](https://patchblox.com/security/data/fix/linux/alsa-2026-25925.md) | Jun 15, 2026 | | Linux | valkey amzn 2023 | 9.0.4-1.amzn2023.0.1 | [ALAS2023-2026-1748](https://patchblox.com/security/data/fix/linux/alas2023-2026-1748.md) | May 25, 2026 | | Linux | valkey ol 10 | 0:8.0.9-1.el10_2 | [ELSA-2026-25216](https://patchblox.com/security/data/fix/linux/elsa-2026-25216.md) | Jul 16, 2026 | | Linux | valkey ol 9 | 0:8.0.9-1.el9_8 | [ELSA-2026-25925](https://patchblox.com/security/data/fix/linux/elsa-2026-25925.md) | Jun 24, 2026 | | Linux | valkey rocky 10 | 0:8.0.9-1.el10_2 | [RLSA-2026:25216](https://patchblox.com/security/data/fix/linux/rlsa-2026-25216.md) | Jun 13, 2026 | | Linux | valkey rocky 9 | 0:8.0.9-1.el9_8 | [RLSA-2026:25925](https://patchblox.com/security/data/fix/linux/rlsa-2026-25925.md) | Jun 17, 2026 | | Linux | valkey-debuginfo amzn 2023 | 9.0.4-1.amzn2023.0.1 | [ALAS2023-2026-1748](https://patchblox.com/security/data/fix/linux/alas2023-2026-1748.md) | May 25, 2026 | | Linux | valkey-debugsource amzn 2023 | 9.0.4-1.amzn2023.0.1 | [ALAS2023-2026-1748](https://patchblox.com/security/data/fix/linux/alas2023-2026-1748.md) | May 25, 2026 | | Linux | valkey-devel RHEL 9 | 0:8.0.9-1.el9_8 | [RHSA-2026:25925](https://patchblox.com/security/data/fix/linux/rhsa-2026-25925.md) | Jun 24, 2026 | | Linux | valkey-devel almalinux 10 | 8.0.9-1.el10_2 | [ALSA-2026:25216](https://patchblox.com/security/data/fix/linux/alsa-2026-25216.md) | Jun 11, 2026 | | Linux | valkey-devel almalinux 9 | 8.0.9-1.el9_8 | [ALSA-2026:25925](https://patchblox.com/security/data/fix/linux/alsa-2026-25925.md) | Jun 15, 2026 | | Linux | valkey-devel amzn 2023 | 9.0.4-1.amzn2023.0.1 | [ALAS2023-2026-1748](https://patchblox.com/security/data/fix/linux/alas2023-2026-1748.md) | May 25, 2026 | | Linux | valkey-devel ol 10 | 0:8.0.9-1.el10_2 | [ELSA-2026-25216](https://patchblox.com/security/data/fix/linux/elsa-2026-25216.md) | Jul 16, 2026 | | Linux | valkey-devel ol 9 | 0:8.0.9-1.el9_8 | [ELSA-2026-25925](https://patchblox.com/security/data/fix/linux/elsa-2026-25925.md) | Jun 24, 2026 | --- Data as of 2026-11-09T01:18:40Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.