Redis has patched a use-after-free in its blocking-client code that lets an authenticated user run arbitrary OS commands on the machine hosting the database. The flaw was found by an autonomous AI tool built to hunt bugs in large codebases. Tracked as CVE-2026-23479, the flaw was introduced in Redis 7.2.0 and remained in every stable branch until the May 5 fixes, unnoticed for over two years.
Autonomous AI Tool Finds 2-Year-Old RCE Flaw in Redis (CVE-2026-23479)
Kurzinfo
Metadaten
- Original (extern): Link oeffnen
- Veroeffentlicht: 2026-06-03 16:40 UTC
- Importiert: 2026-06-10 15:08 UTC
- CVSS: 7.7
- Quelle-ID:
thn_global - uid_hash:
d59c6fa7bac5338e6ac39ca620c176c8bb1191921ad947be1a4d114e7947520c
Inhalt
Verknuepfte CVEs
| CVE-ID | Severity (Quelle) | CVSS (Quelle) | Severity (CVE.org) | CVSS (CVE.org) | EPSS | EPSS-Pctl | Veroeffentlicht (CVE.org) |
|---|---|---|---|---|---|---|---|
HIGH |
7.7 |
HIGH |
7.7 |
2026-05-05 |
Quellen-Details
| Bezeichnung | Name | Kategorie | Tags | Zielgruppe | Sprache | Feed-URL |
|---|---|---|---|---|---|---|
| The Hacker News | security_news | - | de | https://feeds.feedburner.com/TheHackersNews |