CVE-2026-23479 — Redis Use-After-Free RCE PoC Collection
HackSpeak distribution mirror. This repository consolidates three public PoC/detection tools, with code identical to each upstream.
⚠️ Contains actual exploit code and detection tools; for security research, vulnerability verification, and authorized testing only. Run in a disposable environment. Do not use against unauthorized systems.
Vulnerability Summary
CVE-2026-23479 is a Use-After-Free (UAF) vulnerability in Redis (redis-server) that can lead to Remote Code Execution (RCE).
- Root cause:
unblockClientOnKey() (src/blocked.c) does not check the return value of processCommandAndResetClient() → after a blocked client is evicted, it continues to access a freed pointer → UAF;
- Three-stage exploit chain: Lua script leaks heap pointer → heap grooming + UAF trigger → GOT overwrite to achieve RCE;
- Affected versions: ≥ 7.2.0 and < 8.6.3 (7.2.x, 7.4.x, 8.2.x, 8.4.x, 8.6.x);
- Fixed versions: 7.2.14, 7.4.9, 8.2.6, 8.4.3, 8.6.3 (2026-05-05);
- CVSS: ~8.8 (High) per NVD;
- Discovered by: Team Xint Code (ZeroDay.Cloud, an AI autonomous security analysis tool).
Directory Structure
This repository contains three independent PoC/tools:
1. pduggusa-check/ — Safe Read-Only Version Detector
- Source: https://github.com/pduggusa/redis-cve-2026-23479-check
- LICENSE: MIT
- Purpose: Safe read-only detection; only reads the Redis version and determines whether it is affected, without triggering the vulnerability
- Usage:
cd pduggusa-check
python3 check.py --host <Redis地址> --port 6379 [--password <密码>]
- Sigma rules: in the
detection/ directory, for SIEM log detection
2. v1c0mmrt-scanner/ — Vulnerability Scanner
- Source: https://github.com/v1c0mmrt/redis-cve-2026-23479-scanner
- LICENSE: None (not provided upstream)
- Purpose: CVE-2026-23479 vulnerability detection tool, including a scanner and an exploit module
- Usage:
cd v1c0mmrt-scanner
pip install -r requirements.txt
python3 src/redis_cve_scanner.py
3. rizlmaulanaa-poc/ — GDB-Assisted PoC
LICENSE
- pduggusa-check: MIT License (preserved as-is from upstream)
- v1c0mmrt-scanner / rizlmaulanaa-poc: No LICENSE was provided upstream; following distribution convention, this mirror adopts the MIT License, Copyright (c) 2026 HackSpeak. The source code copyright belongs to the respective original authors.
Disclaimer
- For security research, vulnerability verification, and authorized testing only; run in a disposable environment. Do not use against unauthorized systems.
- The full RCE exploit chain requires Lua leak + heap grooming + GOT overwrite, with relatively high attack complexity; some tools are educational PoCs.
References
hackspeak/cve-2026-23479
