CVE-2026-23479 — Redis Use-After-Free RCE PoC Collection

HackSpeak distribution mirror. This repository consolidates three public PoC/detection tools, with code identical to each upstream.

⚠️ Contains actual exploit code and detection tools; for security research, vulnerability verification, and authorized testing only. Run in a disposable environment. Do not use against unauthorized systems.

Vulnerability Summary

CVE-2026-23479 is a Use-After-Free (UAF) vulnerability in Redis (redis-server) that can lead to Remote Code Execution (RCE).

• Root cause: unblockClientOnKey() (src/blocked.c) does not check the return value of processCommandAndResetClient() → after a blocked client is evicted, it continues to access a freed pointer → UAF;
• Three-stage exploit chain: Lua script leaks heap pointer → heap grooming + UAF trigger → GOT overwrite to achieve RCE;
• Affected versions: ≥ 7.2.0 and < 8.6.3 (7.2.x, 7.4.x, 8.2.x, 8.4.x, 8.6.x);
• Fixed versions: 7.2.14, 7.4.9, 8.2.6, 8.4.3, 8.6.3 (2026-05-05);
• CVSS: ~8.8 (High) per NVD;
• Discovered by: Team Xint Code (ZeroDay.Cloud, an AI autonomous security analysis tool).

Directory Structure

This repository contains three independent PoC/tools:

1. pduggusa-check/ — Safe Read-Only Version Detector

• Source: https://github.com/pduggusa/redis-cve-2026-23479-check
• LICENSE: MIT
• Purpose: Safe read-only detection; only reads the Redis version and determines whether it is affected, without triggering the vulnerability
• Usage:

  cd pduggusa-check
  python3 check.py --host <Redis地址> --port 6379 [--password <密码>]
  

• Sigma rules: in the detection/ directory, for SIEM log detection

2. v1c0mmrt-scanner/ — Vulnerability Scanner

• Source: https://github.com/v1c0mmrt/redis-cve-2026-23479-scanner
• LICENSE: None (not provided upstream)
• Purpose: CVE-2026-23479 vulnerability detection tool, including a scanner and an exploit module
• Usage:

  cd v1c0mmrt-scanner
  pip install -r requirements.txt
  python3 src/redis_cve_scanner.py
  

3. rizlmaulanaa-poc/ — GDB-Assisted PoC

• Source: https://github.com/rizlmaulanaa/CVE-2026-23479-Redis-UAF-Proof-of-Concept
• LICENSE: None (not provided upstream)
• Purpose: GDB-assisted UAF exploit demonstration (educational/lab use)
• Files: redisexp.py (exploit script)

LICENSE

• pduggusa-check: MIT License (preserved as-is from upstream)
• v1c0mmrt-scanner / rizlmaulanaa-poc: No LICENSE was provided upstream; following distribution convention, this mirror adopts the MIT License, Copyright (c) 2026 HackSpeak. The source code copyright belongs to the respective original authors.

Disclaimer

• For security research, vulnerability verification, and authorized testing only; run in a disposable environment. Do not use against unauthorized systems.
• The full RCE exploit chain requires Lua leak + heap grooming + GOT overwrite, with relatively high attack complexity; some tools are educational PoCs.

References

• Upstream source repositories:
  • pduggusa-check: https://github.com/pduggusa/redis-cve-2026-23479-check
  • v1c0mmrt-scanner: https://github.com/v1c0mmrt/redis-cve-2026-23479-scanner
  • rizlmaulanaa-poc: https://github.com/rizlmaulanaa/CVE-2026-23479-Redis-UAF-Proof-of-Concept
• ZeroDay.cloud deep analysis: Redis CVE-2026-23479 Deep Dive (Team Xint Code)
• Redis fix commit: c14e9925
• NVD: CVE-2026-23479