CVE-2026-23479: the Use-after-free Redis failure that could turn your server into a remote execution door

A new explosion for Reis, registered as CVE-2026-23479, has replaced the focus on how subtle failures in mature code can become remote execution doors in productive environments. The problem, introduced in branch 7.2.0 and present in the branches stable for more than two years until the patches of May 5, is a classic use-after-free(CWE-416) in the management of blocked customers that allows an attacker with appropriate credentials to take control of the Reis server in certain scenarios.

The technical nature of the failure lies in a function that awakens blocked commands and resends the execution without checking whether the call processing the command has released the client structure. This post-release memory access is the door that opens a three-stage operating chain: heap pointer escape via an EVAL call, placement of a false customer structure in the reused memory, and manipulation of memory accounting to overwrite a bookcase (GOT) and redirect a function to system (), thus achieving CERs. The published explosion shows that with the EVAL functions, CONFIG SET, XREAD / XADD and basic SET / GET operations - all contained in default privileges - it is possible to run arbitrary commands in the host.

The severity metrics are not single: the NVD scores 8.8 under CVSS 3.1 ( NVD CVE-2026-23479) while Reis applies its own valuation with CVSS 4.0 in 7.7, but the real risk vector is defined by the exposure of Reis in the cloud and default settings. Analysis published by researchers and security teams point out that a large proportion of cloud deployments run Reis without a password or with shared credentials between applications, making this failure a much greater practical risk than a mere score in a CVSS.

There are engineering aspects that deserve editorial attention: the bug resulted from the accidental combination of two separate code changes (see the historical requests in the Reis repository, for example PR # 11012 and PR # 11568), no dangerous on its own. This focus, and its permanence after several security reviews, is a call of attention to the limitations of traditional reviews and the added value that offer dynamic analysis and fuzzing specific to memory.

The presence of the official container of Reis complicates the panorama: the official Docker image results in a reduction of protection mechanisms in time of execution (partial RELRO), leaving the Global Offset Table modifiable in containerized environment and facilitating the final stage of the explosion. Since the attack writes relatively to a global variable known in connection time, mitigation as ASLR / PIE in many deployments alone is not enough.

Specific and prioritized actions for managers: update immediately to the parched versions 7.2.14, 7.4.9, 8.2.6, 8.4.3 or 8.6.3 published on 5 May; if you cannot parch immediately, remove instances from public access, force TLS, segmente ACL privileges so that no role combine @ admin, CONFIG and @ scribing, and consider denying @ scribing if you do not use Lua (this prevents the initial leak that facilitates the explosion). In addition, rote shared credentials, prioritize the review of instances exposed to the Internet and check the patch calendar of their managed services (Reis Cloud and others may have already applied corrections). See the official Reis security page for notices and releases: https: / / redis.io / topics / security.

It is also essential to implement detection: look for unusual patterns such as frequent EVAL from service accounts, unexpected configuration changes (CONFIG SET), intensive or strange use of XADD / XREAD streams, and secondary processes that indicate system command execution. For forensic purposes, collect memory logs and snapshots when you suspect engagement, and analyze whether there are unusual rotations or accesses from accounts that previously shared high privileges.

Finally, this finding has broader lessons for industry: a critical error can be born from the interaction of two seemingly harmless changes and remain hidden for years, and the automated tools - including those of AI origin that hunt bug patterns in large code bases - are already playing a real role in discovering sophisticated vectors. The message for development and security equipment is clear: prioritizing memory tests, reviews focused on release / reuse patterns and less permissive default security controls reduces the likelihood of similar problems coming to production.