TLDR Tech / InfoSec
An AI Security Tool Dug Up a 2-Year-Old Redis Bug That Lets Attackers Take Over Servers
CVE-2026-23479, a use-after-free in unblockClientOnKey() present in every Redis stable release since 7.2.0 and rated 7.7 (High), lets authenticated attackers chain a Lua heap leak, forced eviction, and GOT overwrite of strcasecmp() with system() to gain full code execution as the Redis daemon, so self-managed deployments should upgrade to 7.2.14, 7.4.9, 8.2.6, 8.4.3, or 8.6.3 or restrict CONFIG, @scripting, and stream commands until they can.
Read the full story