【OCS】【漏洞修复】CVE-2026-23631：redis高危漏洞

**【软件包名】**
redis

**【CVE ID】**
CVE-2026-23631

**【漏洞评级】**
High

**【评分向量】**
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

**【CWE ID】**
CWE-416

**【漏洞描述】**
Redis is an in-memory data structure store. In all versions of redis-server with Lua scripting, an authenticated attacker can exploit the master-replica synchronization mechanism to trigger a use-after-free on replicas where replica-read-only is disabled or can be disabled, which may lead to remote code execution. A workaround is to prevent users from executing Lua scripts or avoid using replicas where replica-read-only is disabled. This is patched in version 8.6.3.

**【安全评估】**
该漏洞影响>= 7.0.0, < 8.6.3版本的redis，OCS-Stream中redis基线版本为7.2.7-6.tl4，受影响需要修复。
修复建议：
    升级到7.2.15
    补丁链接：https://github.com/redis/redis/commit/80c2b5a0a6de27df5d846c9d25b544c0b4cbac3b
该漏洞影响 redis >= 7.0.0 (继承自 Redis 7.2 fork)。OCS-Stream 中 valkey（v8.0.7-2.oc9），valkey 内嵌了受影响版本的 redis，均在受影响范围内。valkey 自身版本号与 redis 版本无关，修复需在上游 valkey 更新依赖后发布新版本跟进升级。
修复建议：
    升级到7.2.15
    补丁链接：https://github.com/valkey-io/valkey/commit/c7c92db

**【参考链接】**

OpenCloudOS Stream / redis

Content Risk Flag

Comments (0)

OpenCloudOS Stream / redis .gitee-modal { width: 500px !important; }

Content Risk Flag