Critical Redis Bug Allows Remote Attackers to Gain Server Control

A recently disclosed critical Redis bug allows remote attackers to take over the server via a severe Use-After-Free vulnerability in the replication subsystem.

Tracked as CVE-2026-23631 and dubbed DarkReplica, this post-authentication flaw was uncovered during the ZeroDay.Cloud 2025 competition in London.

The researcher earned a $30,000 bounty for demonstrating how the exploit exploits a synchronization flaw in master-replica communication.

Redis utilizes built-in Lua engines to execute atomic functions that manipulate data on the server. To prevent slow or buggy Lua scripts from permanently blocking the single-threaded Redis server, a custom Lua hook runs periodically to detect timeouts.

If a script exceeds the default five-second limit, the hook temporarily yields execution to process pending input and output events from the Redis event loop.

This mechanism ensures the server remains responsive. However, it inadvertently creates a dangerous loophole when cluster replication commands are introduced.

Critical Redis Server Takeover

The core of the vulnerability lies in how the yielding mechanism handles commands from a controller server.

When an attacker connects to the target Redis instance and issues a SLAVEOF command, the target becomes a replica of the attacker-controlled master.

The attacker then triggers a deliberately slow Lua script on the target. This causes the server to yield execution after five seconds.

During this yielding phase, the server continues to process events from the malicious controller server without checking if a script is currently running.

The attacker exploits this blind spot by initiating a full synchronization command from the master. This forces the replica to empty its data and load a new Redis Database file.

During this synchronization, the server clears its current function context and completely frees the global Lua engine object.

Once synchronization finishes, execution resumes the suspended slow script. Because the underlying Lua engine has already been freed, this creates a textbook Use-After-Free scenario.

Turning this vulnerability into reliable code execution requires precise heap manipulation and a deep understanding of the Lua virtual machine.

Attackers must bypass allocator constraints by running the vulnerable slow function inside a Lua coroutine, which operates in its own separate state.

By loading malicious Lua function registration code through the database file, the attacker can spray the heap. They allocate fake objects directly on top of the freed coroutine state to take control of the execution flow, ZeroDay said.

Once the attacker stabilizes the virtual machine, they craft fake Lua tables to achieve robust memory read and write primitives.

These primitives allow the attacker to read server memory and calculate the offsets for underlying system libraries.

By overwriting Lua’s internal memory allocation callback with the C standard library’s execution function, the attacker achieves complete remote server control.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.

The post Critical Redis Bug Allows Remote Attackers to Gain Server Control appeared first on Cyber Security News.