CVE-2026-23631

Redis before version 3.2.7 is vulnerable to 'Cross Protocol Scripting' due to a lack of checks for POST and Host: strings, which are not valid in the Redis protocol.

Integer overflow in the getnum function in lua_struct.c in Redis 2.8.x before 2.8.24 and 3.0.x before 3.0.6 allows context-dependent attackers with permission to run Lua code in a Redis session to cause a denial of service (memory corruption and application crash) or possibly bypass intended sandbox restrictions via a large number, which triggers a stack-based buffer overflow.

Redis versions before 2.8.21 and 3.x before 3.0.2 allow remote attackers to execute arbitrary Lua bytecode via the eval command.

Redis is an open source, in-memory database that persists on disk. In versions 8.2.0 and above, a user can run the XACKDEL command with multiple ID's and trigger a stack buffer overflow, which may potentially lead to remote code execution. This issue is fixed in version 8.2.3. To workaround this issue without patching the redis-server executable is to prevent users from executing XACKDEL operation. This can be done using ACL to restrict XACKDEL command.

In Redis 7.0 prior to 7.0.12, a vulnerability exists that may lead to a heap overflow when extracting key names from a command and a list of arguments. This can result in reading random heap memory, heap corruption, and potentially remote code execution.

The clusterLoadConfig function in Redis 4.0.2 allows attackers to cause a denial of service (out-of-bounds array index and application crash) by leveraging 'limited access to the machine'.

A buffer overflow in Redis versions 3.2.x prior to 3.2.4 can lead to arbitrary code execution when a crafted command is sent. An out of bounds write vulnerability exists in the handling of the client-output-buffer-limit option during the CONFIG SET command.

A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-carrying extensions for null-termination. This oversight allows a remote attacker to craft a malicious packet, leading to an out-of-bounds read when the packet's payload is processed.

Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the privileges of the Redis server.