DEBIAN-CVE-2026-23631
Redis is an in-memory data structure store. In all versions of redis-server with Lua scripting, an authenticated attacker can exploit the master-replica synchronization mechanism to trigger a use-after-free on replicas where replica-read-only is disabled or can be disabled, which may lead to remote code execution. A workaround is to prevent users from executing Lua scripts or avoid using replicas where replica-read-only is disabled. This is patched in version 8.6.3.
DEBIAN-CVE-2026-23631
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:DEBIAN-CVE-2026-23631
redict
Source reference: /affected/0/package/name
- Affected versions
- 7.3.0+ds-1
Source reference:
/affected/0/versions7.3.0+ds-2Source reference:
/affected/0/versions7.3.0+ds-3Source reference:
/affected/0/versions7.3.0+ds-3~bpo12+1Source reference:
/affected/0/versions7.3.1+ds-1Source reference:
/affected/0/versions7.3.2+ds-1Source reference:
/affected/0/versions7.3.2+ds-1~bpo12+1Source reference:
/affected/0/versions7.3.5+ds-1Source reference:
/affected/0/versions7.3.5+ds-1~bpo12+1Source reference:
/affected/0/versions7.3.6+ds-1Source reference:
/affected/0/versions7.3.6+ds-1~bpo12+1Source reference:
/affected/0/versions7.3.6+ds-1~bpo13+1Source reference:
/affected/0/versions7.3.6+ds-2Source reference:
/affected/0/versions7.3.6+ds-2~bpo12+1Source reference:
/affected/0/versions7.3.6+ds-2~bpo13+1Source reference:
/affected/0/versions7.3.6+ds-3Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
redis
Source reference: /affected/1/package/name
- Affected versions
- 5:7.0.11-1
Source reference:
/affected/1/versions5:7.0.11-1+deb12u1Source reference:
/affected/1/versions5:7.0.12-1Source reference:
/affected/1/versions5:7.0.12-2Source reference:
/affected/1/versions5:7.0.13-1Source reference:
/affected/1/versions5:7.0.13-2Source reference:
/affected/1/versions5:7.0.14-1Source reference:
/affected/1/versions5:7.0.14-2Source reference:
/affected/1/versions5:7.0.15-1~deb12u1Source reference:
/affected/1/versions5:7.0.15-1~deb12u2Source reference:
/affected/1/versions5:7.0.15-1~deb12u3Source reference:
/affected/1/versions5:7.0.15-1~deb12u4Source reference:
/affected/1/versions5:7.0.15-1~deb12u5Source reference:
/affected/1/versions5:7.0.15-1~deb12u6Source reference:
/affected/1/versions5:7.0.15-1~deb12u7Source reference:
/affected/1/versions - Fixed versions
- 5:7.0.15-1~deb12u8
Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
redis
Source reference: /affected/2/package/name
- Affected versions
- 5:8.0.2-3
Source reference:
/affected/2/versions5:8.0.2-3+deb13u1Source reference:
/affected/2/versions5:8.0.2-3+deb13u2Source reference:
/affected/2/versions - Fixed versions
- 5:8.0.2-3+deb13u3
Source reference:
/affected/2/ranges - Prerequisites
- Not stated in this record
redis
Source reference: /affected/3/package/name
- Affected versions
- 5:8.0.2-3
Source reference:
/affected/3/versions5:8.0.4-1Source reference:
/affected/3/versions5:8.0.5-1Source reference:
/affected/3/versions5:8.0.6-1Source reference:
/affected/3/versions5:8.0.6-2Source reference:
/affected/3/versions - Fixed versions
- 5:8.0.6-3
Source reference:
/affected/3/ranges - Prerequisites
- Not stated in this record
valkey
Source reference: /affected/4/package/name
- Affected versions
- 8.1.1+dfsg1-3
Source reference:
/affected/4/versions8.1.1+dfsg1-3+deb13u1Source reference:
/affected/4/versions8.1.1+dfsg1-3+deb13u2Source reference:
/affected/4/versions8.1.4+dfsg1-1Source reference:
/affected/4/versions8.1.4+dfsg1-2Source reference:
/affected/4/versions9.1.1-1Source reference:
/affected/4/versions9.1.2-1Source reference:
/affected/4/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
valkey
Source reference: /affected/5/package/name
- Affected versions
- 8.1.1+dfsg1-3
Source reference:
/affected/5/versions8.1.4+dfsg1-1Source reference:
/affected/5/versions8.1.4+dfsg1-2Source reference:
/affected/5/versions - Fixed versions
- 9.1.1-1
Source reference:
/affected/5/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "redict",
"purl": "pkg:deb/debian/redict?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"7.3.0+ds-1",
"7.3.0+ds-2",
"7.3.0+ds-3",
"7.3.0+ds-3~bpo12+1",
"7.3.1+ds-1",
"7.3.2+ds-1",
"7.3.2+ds-1~bpo12+1",
"7.3.5+ds-1",
"7.3.5+ds-1~bpo12+1",
"7.3.6+ds-1",
"7.3.6+ds-1~bpo12+1",
"7.3.6+ds-1~bpo13+1",
"7.3.6+ds-2",
"7.3.6+ds-2~bpo12+1",
"7.3.6+ds-2~bpo13+1",
"7.3.6+ds-3"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-23631.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "5:7.0.15-1~deb12u8"
}
]
}
],
"package": {
"name": "redis",
"purl": "pkg:deb/debian/redis?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"5:7.0.11-1",
"5:7.0.11-1+deb12u1",
"5:7.0.12-1",
"5:7.0.12-2",
"5:7.0.13-1",
"5:7.0.13-2",
"5:7.0.14-1",
"5:7.0.14-2",
"5:7.0.15-1~deb12u1",
"5:7.0.15-1~deb12u2",
"5:7.0.15-1~deb12u3",
"5:7.0.15-1~deb12u4",
"5:7.0.15-1~deb12u5",
"5:7.0.15-1~deb12u6",
"5:7.0.15-1~deb12u7"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-23631.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "5:8.0.2-3+deb13u3"
}
]
}
],
"package": {
"name": "redis",
"purl": "pkg:deb/debian/redis?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"5:8.0.2-3",
"5:8.0.2-3+deb13u1",
"5:8.0.2-3+deb13u2"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-23631.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "5:8.0.6-3"
}
]
}
],
"package": {
"name": "redis",
"purl": "pkg:deb/debian/redis?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"5:8.0.2-3",
"5:8.0.4-1",
"5:8.0.5-1",
"5:8.0.6-1",
"5:8.0.6-2"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-23631.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "valkey",
"purl": "pkg:deb/debian/valkey?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"8.1.1+dfsg1-3",
"8.1.1+dfsg1-3+deb13u1",
"8.1.1+dfsg1-3+deb13u2",
"8.1.4+dfsg1-1",
"8.1.4+dfsg1-2",
"9.1.1-1",
"9.1.2-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-23631.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "9.1.1-1"
}
]
}
],
"package": {
"name": "valkey",
"purl": "pkg:deb/debian/valkey?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"8.1.1+dfsg1-3",
"8.1.4+dfsg1-1",
"8.1.4+dfsg1-2"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-23631.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
]- Related CVEs
- CVE-2026-23631
Source reference:
/upstream
Publisher severity
high
Source reference: /severity/0/score
- Event
- #67711 · Revision 1
- Added to Heist Feed
- Publisher date