Critical Remote Code Execution Vulnerability in Redis Package
Summary
ALSA-2026:25219: Important: redis:7 security update. Affects redis versions < 7.2.14-1.module_el9.8.0+258+b8f945d3. Fixed in 7.2.14-1.module_el9.8.0+258+b8f945d3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Redis is an advanced key-value store often referred to as a data-structure server due to its ability to handle various data types such as strings, hashes, lists, sets, and sorted sets. It operates primarily in-memory for performance, with options for data persistence through periodic dumps or command logging. This flexibility makes Redis a popular choice for caching and real-time analytics, but it also introduces potential security vulnerabilities, particularly when handling user input and executing scripts.
Vulnerability Detail
The vulnerability in Redis arises from a use-after-free error in the unblock client flow, which could allow an attacker to execute arbitrary code remotely (CVE-2026-23479). Additionally, a similar use-after-free issue in Lua scripting (CVE-2026-23631) poses a risk of remote code execution. Furthermore, the RESTORE command has been identified to cause invalid memory access, leading to potential remote code execution (CVE-2026-25243). These vulnerabilities can be exploited by attackers to gain unauthorized access and control over the Redis server, posing significant risks to data integrity and system security.
How To Fix
Minimum fixed version
7.2.14-1.module_el9.8.0+258+b8f945d3
This is the first release that contains the fix.
sudo dnf update redisTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider disabling Lua scripting and restricting access to the Redis server to trusted IP addresses only. This can help mitigate the risk until the package is updated. You can disable Lua scripting by setting 'lua-disabled' in the Redis configuration file.
Conclusion
The Redis package has critical vulnerabilities that could allow remote code execution. It is crucial to update to the latest patched version to secure your system. Implementing temporary workarounds can help mitigate risks until the update is applied. Regular monitoring for vulnerabilities is essential for maintaining software security.
See every vulnerability recorded for redis →
FAQ
The vulnerabilities involve use-after-free errors and invalid memory access, which can lead to remote code execution.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
Exploitation of these vulnerabilities can lead to unauthorized access, data corruption, and complete control over the Redis server.
Yes, you can disable Lua scripting and restrict access to trusted IP addresses as a temporary workaround.
Regularly check for updates and vulnerabilities, ideally integrating automated tools like Vulert to monitor your dependencies continuously.
Related vulnerabilities
Recent vulnerabilities recorded for redis.
