Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Justification
Impact
py3-redis packages redis-py, the pure-Python Redis client (PyPI 'redis', github.com/redis/redis-py). CVE-2026-23631 is a use-after-free in redis-server reachable via Lua scripting and master-replica synchronization (authenticated RCE), patched in redis-server 8.6.3 — a flaw in the server's C implementation that cannot affect a Python client, which only sends commands and parses replies. The detection is a CPE collision: redis-py is versioned 8.0.0 (Redis 8.x server line) and shares cpe:2.3:a:redis:redis with the server.
Status