RHSA-2026:25219

Vulnerability from csaf_redhat - Published: 2026-06-11 11:44 - Updated: 2026-06-11 11:45
Summary
Red Hat Security Advisory: redis:7 security update
Severity
Important
Notes
Topic: An update for the redis:7 module is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, or by appending each command to a log. Security Fix(es): * redis: use-after-free in unblock client flow may allow remote code execution (CVE-2026-23479) * redis: Remote code execution via use-after-free in Lua scripting (CVE-2026-23631) * redis: RESTORE invalid memory access may allow remote code execution (CVE-2026-25243) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2026-23479

A flaw was found in Redis. The unblock client flow does not handle an error return from the `processCommandAndResetClient` when re-executing a blocked command. If a blocked client is evicted during this flow, an authenticated attacker can cause a use-after-free issue. This potentially leads to arbitrary code execution.

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-416 - Use After Free
Affected products
Product Identifier Version Remediation
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.src::redis:7 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-doc-0:7.2.14-1.module+el9.8.0+24327+41ceb644.noarch::redis:7 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-23631

A flaw was found in Redis, an in-memory data structure store. An authenticated attacker can exploit a use-after-free vulnerability in redis-server with Lua scripting. This occurs through the master-replica synchronization mechanism on replicas where replica-read-only is disabled or can be disabled. Successful exploitation may lead to remote code execution.

8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-416 - Use After Free
Affected products
Product Identifier Version Remediation
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.src::redis:7 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-doc-0:7.2.14-1.module+el9.8.0+24327+41ceb644.noarch::redis:7 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-25243

A flaw was found in Redis. An authenticated attacker with permission to execute the RESTORE command can send a crafted serialized payload that may lead to an invalid memory access due to an improper validation of the serialized values. This flaw can cause the server to crash and may allow arbitrary code execution.

8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-122 - Heap-based Buffer Overflow
Affected products
Product Identifier Version Remediation
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.src::redis:7 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-doc-0:7.2.14-1.module+el9.8.0+24327+41ceb644.noarch::redis:7 —
Vendor Fix fix
Workaround
Threats
Impact Important
References
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for the redis:7 module is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, or by appending each command to a log.\n\nSecurity Fix(es):\n\n* redis: use-after-free in unblock client flow may allow remote code execution (CVE-2026-23479)\n\n* redis: Remote code execution via use-after-free in Lua scripting (CVE-2026-23631)\n\n* redis: RESTORE invalid memory access may allow remote code execution (CVE-2026-25243)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:25219",
        "url": "https://access.redhat.com/errata/RHSA-2026:25219"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2466780",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466780"
      },
      {
        "category": "external",
        "summary": "2466788",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466788"
      },
      {
        "category": "external",
        "summary": "2466828",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466828"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_25219.json"
      }
    ],
    "title": "Red Hat Security Advisory: redis:7 security update",
    "tracking": {
      "current_release_date": "2026-06-11T11:45:22+00:00",
      "generator": {
        "date": "2026-06-11T11:45:22+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.8.2"
        }
      },
      "id": "RHSA-2026:25219",
      "initial_release_date": "2026-06-11T11:44:56+00:00",
      "revision_history": [
        {
          "date": "2026-06-11T11:44:56+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-06-11T11:44:56+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-06-11T11:45:22+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                  "product_id": "AppStream-9.8.0.Z.MAIN.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:9::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.src::redis:7",
                "product": {
                  "name": "redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.src (redis:7)",
                  "product_id": "redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.src::redis:7",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis@7.2.14-1.module%2Bel9.8.0%2B24327%2B41ceb644?arch=src\u0026rpmmod=redis:7:9080020260521083756:9"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "redis-doc-0:7.2.14-1.module+el9.8.0+24327+41ceb644.noarch::redis:7",
                "product": {
                  "name": "redis-doc-0:7.2.14-1.module+el9.8.0+24327+41ceb644.noarch (redis:7)",
                  "product_id": "redis-doc-0:7.2.14-1.module+el9.8.0+24327+41ceb644.noarch::redis:7",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis-doc@7.2.14-1.module%2Bel9.8.0%2B24327%2B41ceb644?arch=noarch\u0026rpmmod=redis:7:9080020260521083756:9"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7",
                "product": {
                  "name": "redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64 (redis:7)",
                  "product_id": "redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis@7.2.14-1.module%2Bel9.8.0%2B24327%2B41ceb644?arch=aarch64\u0026rpmmod=redis:7:9080020260521083756:9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7",
                "product": {
                  "name": "redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64 (redis:7)",
                  "product_id": "redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis-debuginfo@7.2.14-1.module%2Bel9.8.0%2B24327%2B41ceb644?arch=aarch64\u0026rpmmod=redis:7:9080020260521083756:9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7",
                "product": {
                  "name": "redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64 (redis:7)",
                  "product_id": "redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis-debugsource@7.2.14-1.module%2Bel9.8.0%2B24327%2B41ceb644?arch=aarch64\u0026rpmmod=redis:7:9080020260521083756:9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7",
                "product": {
                  "name": "redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64 (redis:7)",
                  "product_id": "redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis-devel@7.2.14-1.module%2Bel9.8.0%2B24327%2B41ceb644?arch=aarch64\u0026rpmmod=redis:7:9080020260521083756:9"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7",
                "product": {
                  "name": "redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le (redis:7)",
                  "product_id": "redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis@7.2.14-1.module%2Bel9.8.0%2B24327%2B41ceb644?arch=ppc64le\u0026rpmmod=redis:7:9080020260521083756:9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7",
                "product": {
                  "name": "redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le (redis:7)",
                  "product_id": "redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis-debuginfo@7.2.14-1.module%2Bel9.8.0%2B24327%2B41ceb644?arch=ppc64le\u0026rpmmod=redis:7:9080020260521083756:9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7",
                "product": {
                  "name": "redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le (redis:7)",
                  "product_id": "redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis-debugsource@7.2.14-1.module%2Bel9.8.0%2B24327%2B41ceb644?arch=ppc64le\u0026rpmmod=redis:7:9080020260521083756:9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7",
                "product": {
                  "name": "redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le (redis:7)",
                  "product_id": "redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis-devel@7.2.14-1.module%2Bel9.8.0%2B24327%2B41ceb644?arch=ppc64le\u0026rpmmod=redis:7:9080020260521083756:9"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7",
                "product": {
                  "name": "redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x (redis:7)",
                  "product_id": "redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis@7.2.14-1.module%2Bel9.8.0%2B24327%2B41ceb644?arch=s390x\u0026rpmmod=redis:7:9080020260521083756:9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7",
                "product": {
                  "name": "redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x (redis:7)",
                  "product_id": "redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis-debuginfo@7.2.14-1.module%2Bel9.8.0%2B24327%2B41ceb644?arch=s390x\u0026rpmmod=redis:7:9080020260521083756:9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7",
                "product": {
                  "name": "redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x (redis:7)",
                  "product_id": "redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis-debugsource@7.2.14-1.module%2Bel9.8.0%2B24327%2B41ceb644?arch=s390x\u0026rpmmod=redis:7:9080020260521083756:9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7",
                "product": {
                  "name": "redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x (redis:7)",
                  "product_id": "redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis-devel@7.2.14-1.module%2Bel9.8.0%2B24327%2B41ceb644?arch=s390x\u0026rpmmod=redis:7:9080020260521083756:9"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7",
                "product": {
                  "name": "redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64 (redis:7)",
                  "product_id": "redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis@7.2.14-1.module%2Bel9.8.0%2B24327%2B41ceb644?arch=x86_64\u0026rpmmod=redis:7:9080020260521083756:9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7",
                "product": {
                  "name": "redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64 (redis:7)",
                  "product_id": "redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis-debuginfo@7.2.14-1.module%2Bel9.8.0%2B24327%2B41ceb644?arch=x86_64\u0026rpmmod=redis:7:9080020260521083756:9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7",
                "product": {
                  "name": "redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64 (redis:7)",
                  "product_id": "redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis-debugsource@7.2.14-1.module%2Bel9.8.0%2B24327%2B41ceb644?arch=x86_64\u0026rpmmod=redis:7:9080020260521083756:9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7",
                "product": {
                  "name": "redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64 (redis:7)",
                  "product_id": "redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis-devel@7.2.14-1.module%2Bel9.8.0%2B24327%2B41ceb644?arch=x86_64\u0026rpmmod=redis:7:9080020260521083756:9"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64 (redis:7) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7"
        },
        "product_reference": "redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le (redis:7) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7"
        },
        "product_reference": "redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x (redis:7) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7"
        },
        "product_reference": "redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.src (redis:7) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.src::redis:7"
        },
        "product_reference": "redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.src::redis:7",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64 (redis:7) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7"
        },
        "product_reference": "redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64 (redis:7) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7"
        },
        "product_reference": "redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le (redis:7) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7"
        },
        "product_reference": "redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x (redis:7) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7"
        },
        "product_reference": "redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64 (redis:7) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7"
        },
        "product_reference": "redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64 (redis:7) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7"
        },
        "product_reference": "redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le (redis:7) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7"
        },
        "product_reference": "redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x (redis:7) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7"
        },
        "product_reference": "redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64 (redis:7) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7"
        },
        "product_reference": "redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64 (redis:7) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7"
        },
        "product_reference": "redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le (redis:7) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7"
        },
        "product_reference": "redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x (redis:7) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7"
        },
        "product_reference": "redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64 (redis:7) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7"
        },
        "product_reference": "redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-doc-0:7.2.14-1.module+el9.8.0+24327+41ceb644.noarch (redis:7) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:redis-doc-0:7.2.14-1.module+el9.8.0+24327+41ceb644.noarch::redis:7"
        },
        "product_reference": "redis-doc-0:7.2.14-1.module+el9.8.0+24327+41ceb644.noarch::redis:7",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-23479",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "discovery_date": "2026-05-05T17:01:54.051832+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2466780"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Redis. The unblock client flow does not handle an error return from the `processCommandAndResetClient` when re-executing a blocked command. If a blocked client is evicted during this flow, an authenticated attacker can cause a use-after-free issue. This potentially leads to arbitrary code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "redis: use-after-free in unblock client flow may allow remote code execution",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "To exploit this flaw, a highly specific sequence of events and time dependent conditions that are not directly in control of an attacker must occur, increasing the complexity of exploitation. Additionally, the attacker needs to be authenticated, limiting the exposure of this issue. To reflect these conditions, this vulnerability has been rated with an important severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.src::redis:7",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-doc-0:7.2.14-1.module+el9.8.0+24327+41ceb644.noarch::redis:7"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-23479"
        },
        {
          "category": "external",
          "summary": "RHBZ#2466780",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466780"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-23479",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-23479"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-23479",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23479"
        },
        {
          "category": "external",
          "summary": "https://github.com/redis/redis/releases/tag/8.6.3",
          "url": "https://github.com/redis/redis/releases/tag/8.6.3"
        },
        {
          "category": "external",
          "summary": "https://github.com/redis/redis/security/advisories/GHSA-93m2-935m-8rj3",
          "url": "https://github.com/redis/redis/security/advisories/GHSA-93m2-935m-8rj3"
        }
      ],
      "release_date": "2026-05-05T16:36:05.486000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-11T11:44:56+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.src::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-doc-0:7.2.14-1.module+el9.8.0+24327+41ceb644.noarch::redis:7"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:25219"
        },
        {
          "category": "workaround",
          "details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.src::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-doc-0:7.2.14-1.module+el9.8.0+24327+41ceb644.noarch::redis:7"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.src::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-doc-0:7.2.14-1.module+el9.8.0+24327+41ceb644.noarch::redis:7"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "redis: use-after-free in unblock client flow may allow remote code execution"
    },
    {
      "cve": "CVE-2026-23631",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "discovery_date": "2026-05-05T17:02:23.286903+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2466788"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Redis, an in-memory data structure store. An authenticated attacker can exploit a use-after-free vulnerability in redis-server with Lua scripting. This occurs through the master-replica synchronization mechanism on replicas where replica-read-only is disabled or can be disabled. Successful exploitation may lead to remote code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "redis: Remote code execution via use-after-free in Lua scripting",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important vulnerability in Redis affects instances configured with Lua scripting and operating as replicas where the `replica-read-only` setting is disabled or can be modified by an authenticated attacker. Exploitation of a use-after-free flaw during master-replica synchronization could lead to remote code execution. The risk is present in deployments where Redis replicas are configured for write operations or lack sufficient access controls to prevent modification of the `replica-read-only` setting.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.src::redis:7",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-doc-0:7.2.14-1.module+el9.8.0+24327+41ceb644.noarch::redis:7"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-23631"
        },
        {
          "category": "external",
          "summary": "RHBZ#2466788",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466788"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-23631",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-23631"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-23631",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23631"
        },
        {
          "category": "external",
          "summary": "https://github.com/redis/redis/releases/tag/8.6.3",
          "url": "https://github.com/redis/redis/releases/tag/8.6.3"
        },
        {
          "category": "external",
          "summary": "https://github.com/redis/redis/security/advisories/GHSA-8ghh-qpmp-7826",
          "url": "https://github.com/redis/redis/security/advisories/GHSA-8ghh-qpmp-7826"
        }
      ],
      "release_date": "2026-05-05T16:39:32.337000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-11T11:44:56+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.src::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-doc-0:7.2.14-1.module+el9.8.0+24327+41ceb644.noarch::redis:7"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:25219"
        },
        {
          "category": "workaround",
          "details": "To mitigate this flaw, ensure that Redis replicas maintain `replica-read-only` as enabled and prevent its modification by unauthorized users. If Lua scripting is not a required feature, consider disabling it to reduce the attack surface. Restricting network access to Redis instances to trusted clients can also limit exposure.\nFor Redis configuration, edit the `redis.conf` file to include or verify:\n`replica-read-only yes`\nAfter modifying the configuration, restart the Redis service for the changes to take effect. This action will temporarily interrupt service availability.",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.src::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-doc-0:7.2.14-1.module+el9.8.0+24327+41ceb644.noarch::redis:7"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.src::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-doc-0:7.2.14-1.module+el9.8.0+24327+41ceb644.noarch::redis:7"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "redis: Remote code execution via use-after-free in Lua scripting"
    },
    {
      "cve": "CVE-2026-25243",
      "cwe": {
        "id": "CWE-122",
        "name": "Heap-based Buffer Overflow"
      },
      "discovery_date": "2026-05-05T18:01:12.034461+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2466828"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Redis. An authenticated attacker with permission to execute the RESTORE command can send a crafted serialized payload that may lead to an invalid memory access due to an improper validation of the serialized values. This flaw can cause the server to crash and may allow arbitrary code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "redis: RESTORE invalid memory access may allow remote code execution",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "To exploit this issue, an authenticated attacker with permission to execute the RESTORE command needs to send a specially crafted serialized payload to be processed by Redis, limiting its exposure to authenticated users. This allows the attacker to cause an invalid memory access, resulting in a denial of service or potentially in arbitrary code execution.\n\nDefault Red Hat Enterprise Linux security features, including SELinux enforcement, Address Space Layout Randomization (ASLR) and NX (No-Execute) stack protection, significantly increase the difficulty of achieving arbitrary code execution, limiting the impact of this vulnerability.\n\nDue to these reasons, this vulnerability has been rated with an important severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.src::redis:7",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-doc-0:7.2.14-1.module+el9.8.0+24327+41ceb644.noarch::redis:7"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-25243"
        },
        {
          "category": "external",
          "summary": "RHBZ#2466828",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466828"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-25243",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-25243"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25243",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25243"
        },
        {
          "category": "external",
          "summary": "https://github.com/redis/redis/releases/tag/8.6.3",
          "url": "https://github.com/redis/redis/releases/tag/8.6.3"
        },
        {
          "category": "external",
          "summary": "https://github.com/redis/redis/security/advisories/GHSA-c8h9-259x-jff4",
          "url": "https://github.com/redis/redis/security/advisories/GHSA-c8h9-259x-jff4"
        }
      ],
      "release_date": "2026-05-05T16:44:57.306000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-11T11:44:56+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.src::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-doc-0:7.2.14-1.module+el9.8.0+24327+41ceb644.noarch::redis:7"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:25219"
        },
        {
          "category": "workaround",
          "details": "To mitigate this flaw, restrict the execution privileges of the RESTORE command exclusively to highly trusted and administrative users by using the appropriate ACL rules.",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.src::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-doc-0:7.2.14-1.module+el9.8.0+24327+41ceb644.noarch::redis:7"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.src::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.aarch64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.ppc64le::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.s390x::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:7.2.14-1.module+el9.8.0+24327+41ceb644.x86_64::redis:7",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-doc-0:7.2.14-1.module+el9.8.0+24327+41ceb644.noarch::redis:7"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "redis: RESTORE invalid memory access may allow remote code execution"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.