ALAS2023-2026-1748

References: CVE-2026-23479  CVE-2026-23631  CVE-2026-25243 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

Redis is an in-memory data structure store. In redis-server from 7.2.0 until 8.6.3, the unblock client flow does not handle an error return from `processCommandAndResetClient` when re-executing a blocked command. If a blocked client is evicted during this flow, an authenticated attacker can trigger a use-after-free that may lead to remote code execution. This has been patched in version 8.6.3. (CVE-2026-23479)

Redis is an in-memory data structure store. In all versions of redis-server with Lua scripting, an authenticated attacker can exploit the master-replica synchronization mechanism to trigger a use-after-free on replicas where replica-read-only is disabled or can be disabled, which may lead to remote code execution. A workaround is to prevent users from executing Lua scripts or avoid using replicas where replica-read-only is disabled. This is patched in version 8.6.3. (CVE-2026-23631)

Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This is patched in version 8.6.3. (CVE-2026-25243)

Issue Correction:
Run dnf update valkey --releasever 2023.11.20260526 or dnf update --advisory ALAS2023-2026-1748 --releasever 2023.11.20260526 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation

New Packages:

aarch64:
    valkey-debuginfo-9.0.4-1.amzn2023.0.1.aarch64
    valkey-devel-9.0.4-1.amzn2023.0.1.aarch64
    valkey-9.0.4-1.amzn2023.0.1.aarch64
    valkey-debugsource-9.0.4-1.amzn2023.0.1.aarch64

src:
    valkey-9.0.4-1.amzn2023.0.1.src

x86_64:
    valkey-debuginfo-9.0.4-1.amzn2023.0.1.x86_64
    valkey-devel-9.0.4-1.amzn2023.0.1.x86_64
    valkey-debugsource-9.0.4-1.amzn2023.0.1.x86_64
    valkey-9.0.4-1.amzn2023.0.1.x86_64