An authenticated use-after-free vulnerability in Redis redis-server allows remote code execution via command re-execution errors.

This is a use-after-free vulnerability (CWE-416) caused by improper error handling during the unblock client flow when re-executing a blocked command, requiring low privileges for successful exploitation.

A successful exploit could allow an attacker to achieve remote code execution on the underlying database server, potentially leading to total system compromise, data theft, or prolonged service disruption. The CVSS score of 8.8 reflects the high severity of potential confidentiality, integrity, and availability impacts.

Immediate Action: Update redis-server to version 8.6.3 or later as provided by the vendor security advisory.

Proactive Monitoring: Monitor server logs for unusual client disconnection patterns, memory consumption anomalies, or unexpected process restarts.

Compensating Controls: Restrict network access to the Redis service using strict firewall rules and limit database user privileges to minimize potential exposure.

Public Exploit Available: Yes, multiple public proof-of-concept repositories exist on GitHub.

Organizations running vulnerable versions of Redis should prioritize updating to version 8.6.3 immediately to eliminate the use-after-free vector. Network segmentation and strict access controls must be maintained to prevent unauthorized users from interacting with the database service.