Summary
[7.2.14-1.0.1]
- Build with 64k pages to support redis on UEK on aarch64
[7.2.14-1]
- rebase to 7.2.14 for CVE-2026-23479 CVE-2026-25243 CVE-2026-23631
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | redis | 0:7.2.14-1.0.1.module+el9.8.0+90920+b17784e3 |
| Oracle Linux · 9 | redis-devel | 0:7.2.14-1.0.1.module+el9.8.0+90920+b17784e3 |
| Oracle Linux · 9 | redis-doc | 0:7.2.14-1.0.1.module+el9.8.0+90920+b17784e3 |
Vulnerabilities 3
-
High 7.7CVE-2026-23479 Public exploit
redis-server use-after-free in unblock client flow may allow remote code execution
Redis is an in-memory data structure store. In redis-server from 7.2.0 until 8.6.3, the unblock client flow does not handle an error return from `processCommandAndResetClient` when re-executing a blocked command. If a blocked client is evicted during this flo…
-
High 7.7CVE-2026-25243 Public exploit
redis-server RESTORE invalid memory access may allow remote code execution
Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE can supply a crafted serialized payload that tr…
-
Medium 6.1CVE-2026-23631 Public exploit
redis-server Lua use-after-free may allow remote code execution
Redis is an in-memory data structure store. In all versions of redis-server with Lua scripting, an authenticated attacker can exploit the master-replica synchronization mechanism to trigger a use-after-free on replicas where replica-read-only is disabled or c…