PoC Released for Redis RCE Use-After-Free Flaw

Researchers published a proof-of-concept exploit for a Redis heap use-after-free in blocked-client handling that can enable remote code execution as the Redis server process (tracked as CVE-2026-23479). The flaw allows re-execution of a blocked client command to free a sibling client and read reclaimed memory, which the researcher chained into arbitrary command execution via heap grooming; the upstream patch is in Redis 8.8.2 and organizations are advised to update, restrict network access, enforce authentication, and remove risky privileges if immediate patching is not possible.