Loading story…
Redis disclosed five vulnerabilities affecting Redis Cloud, Redis Software, and Redis OSS/CE that could allow authenticated attackers to achieve remote code execution, system compromise, data exfiltration, or service disruption. The issues tracked as CVE-2026-23479, CVE-2026-25243, CVE-2026-25588, CVE-2026-25589, and CVE-2026-23631 include an invalid memory access flaw in the RESTORE command, a use-after-free bug in the unblock client flow, and a Lua use-after-free condition in certain replica configurations. Public advisories and downstream alerts described four of the bugs as high severity and one as medium severity, with multiple flaws capable of leading to arbitrary code execution.
Redis said Redis Cloud deployments had already been patched and required no customer action, while self-managed users were told to upgrade to fixed releases across Redis OSS/CE, Redis Software, RedisTimeSeries, and RedisBloom. Government and national CERT notices echoed the vendor guidance and urged administrators to review the advisories and apply updates promptly. Redis also said it had no evidence of active exploitation at publication time, but recommended immediate patching and hardening measures such as restricting network exposure, enforcing strong authentication, keeping protected mode enabled where appropriate, and applying least-privilege access controls.
See real exploitation activity before you spend the cycle.
6 events from the most recent confirmed update back to the earliest known activity.
On 2026-05-06, dCERT issued advisory 2026-1346 warning that multiple Redis vulnerabilities could allow execution of arbitrary code. The notice amplified the vendor disclosure for defenders and administrators.
On 2026-05-05, the Canadian Centre for Cyber Security published alert AV26-423 highlighting Redis's advisory and urging administrators to review the vendor guidance and apply necessary updates. The alert framed the issue as a vendor-driven vulnerability notification rather than evidence of an active intrusion campaign.
In its May 5, 2026 disclosure, Redis said it had no evidence that the vulnerabilities were being actively exploited in the wild at the time of publication. The company nevertheless urged immediate patching and deployment hardening measures such as network restrictions, strong authentication, protected mode, and least-privilege access.
As part of the 2026-05-05 advisory, Redis directed self-managed users to upgrade to fixed versions across Redis OSS/CE, Redis Software, RedisTimeSeries, and RedisBloom. Redis also stated that Redis Cloud deployments had already been patched and required no customer action.
On 2026-05-05, Redis published GitHub security advisories detailing specific vulnerability classes, including invalid memory access in the RESTORE command, a use-after-free in the unblock client flow, and a Lua use-after-free issue. These advisories provided the technical characterization of multiple flaws that could lead to remote code execution.
On 2026-05-05, Redis published a security advisory covering five vulnerabilities affecting Redis Software and Redis OSS/CE: CVE-2026-23479, CVE-2026-25243, CVE-2026-25588, CVE-2026-25589, and CVE-2026-23631. The flaws were described as enabling impacts including remote code execution, system compromise, data exfiltration, or service disruption under certain conditions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
7 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcedcert.de
Open sourcecyber.gc.ca
Open sourcegithub.com
Open sourceredis.io
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Redis disclosed and fixed five vulnerabilities in Redis OSS/CE, including four high-severity issues and one medium-severity flaw, warning that several bugs could lead to remote code execution after authentication. The most serious issue, **`CVE-2026-23479`**, is a use-after-free in blocking-client code that can enable arbitrary OS command execution on the host running Redis; Redis said it affects versions beginning with `7.2.0` across multiple stable branches. The broader set of flaws also includes invalid memory access bugs in the `RESTORE` command, including module-specific cases involving **RedisTimeSeries** and **RedisBloom**, as well as a Lua use-after-free affecting certain replica configurations.
Jun 29, 2026
Researchers disclosed multiple authenticated remote code execution paths in Redis, showing how users with valid Redis credentials could potentially escalate from datastore access to host-level shell access on stock builds including Redis `6.2.22`, `7.4.9`, `8.6.4`, and `8.8.0`. The reported issues include a stream consumer-group shared-`NACK` double-free linked to the `CVE-2026-25589` incomplete-fix family and a heap overflow in the bundled RedisBloom `TDigest` module affecting Redis `8.8.0`. The attack chains rely on commonly enabled capabilities such as `EVAL`, `RESTORE`, and `XGROUP`, and the report said the double-free was only fully fixed in `8.8.0` while that same release still remained exposed to the RedisBloom bug at disclosure time. At the same time, new offensive-security tooling emerged to help identify exposed Redis deployments. A Rapid7 Metasploit pull request introduced an auxiliary scanner for `CVE-2025-49844` ("RediShell") that checks whether a Redis server is running an unpatched branch and whether Lua `EVAL` is reachable, highlighting how configuration choices such as ACLs can reduce practical exploitability even on vulnerable versions. The combined disclosures underscore the need to patch Redis promptly, restrict dangerous commands, keep Redis off the public internet, rotate credentials, review RedisBloom usage, and monitor for anomalous command activity that could indicate exploitation attempts.
Jul 24, 2026
A critical security vulnerability, tracked as CVE-2025-49844, has been identified in Redis, an open-source, in-memory database widely used for caching and data storage. The flaw is rated with a CVSS score of 10.0, indicating maximum severity and potential for significant impact. This vulnerability arises from a use-after-free condition in the Lua scripting engine of Redis, which can be exploited by an authenticated user. By crafting a malicious Lua script, an attacker can manipulate the garbage collector within Redis, triggering the use-after-free bug. Successful exploitation of this flaw allows remote code execution on the affected Redis server, granting attackers the ability to run arbitrary code with the privileges of the Redis process. All Redis versions up to and including 8.2.1 are affected by this vulnerability, as they include the vulnerable Lua scripting functionality. The issue has been addressed in Redis version 8.2.2, which contains the necessary patch to remediate the flaw. As an immediate mitigation for organizations unable to upgrade, Redis administrators are advised to restrict the execution of Lua scripts by disabling the EVAL and EVALSHA commands through Access Control Lists (ACLs). The vulnerability requires authentication, but in environments where Redis is exposed to untrusted users or where credentials are weak, the risk of exploitation is heightened. Security advisories recommend prompt patching and review of user permissions to minimize exposure. The flaw was publicly disclosed in early October 2025, and security researchers have emphasized the critical nature of the bug due to its potential for remote exploitation. No specific products beyond Redis itself have been listed as affected, but any deployment using vulnerable versions is at risk. The vulnerability has been confirmed to be remotely exploitable, making it a high-priority issue for organizations relying on Redis for critical infrastructure. The security community has highlighted the importance of monitoring for suspicious Lua script activity as an additional detection measure. Redis users are urged to consult official advisories and update their systems as soon as possible to prevent compromise. The disclosure underscores the ongoing risks associated with embedded scripting engines in widely deployed software. Organizations should also review their network exposure and ensure Redis instances are not accessible from untrusted networks. The incident serves as a reminder of the importance of timely patch management and the need for defense-in-depth strategies in database deployments.
Jul 23, 2026