Autonomous AI Tool Finds 2-Year-Old RCE Flaw in Redis (CVE-2026-23479)

CVE-2026-23479 is a use-after-free vulnerability in Redis's blocking-client code located in unblockClientOnKey() function in src/blocked.c. The flaw occurs when a key event wakes a blocked command, and the function dispatches the queued command through processCommandAndResetClient(), then continues using the same client pointer. The processCommandAndResetClient() function can free the client as a side effect, but the caller ignores the return value and reads the freed structure anyway, causing a use-after-free (CWE-416). The exploit chain works in three stages: 1) Leaking a heap address using a one-line Lua script (EVAL "return tostring(redis.call)" 0), 2) Grooming client memory limits and using a pipelined SET to reclaim the freed slot with a fake client structure, 3) Using Redis's memory accounting in updateClientMemoryUsage() to perform an out-of-bounds decrement aimed at the Global Offset Table to repoint strcasecmp() at system(). The vulnerability was introduced by two separate commits in 2023 - a January refactor (PR #11012) that added the unchecked call, and a March change (PR #11568) that added more client access after it.