CVE-2023-28859: Redis Redis-Py

Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days.

redis-py before 4.4.4 and 4.5.x before 4.5.4 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request. (This could, for example, happen for a non-pipeline operation.) NOTE: the solutions for CVE-2023-28859 address data leakage across AsyncIO connections in general.

Affected products

• Redis Redis-Py: from 4.2.0, before 4.4.4 (fixed in 4.4.4); from 4.5.0, before 4.5.4 (fixed in 4.5.4)

Published 2023-03-26. Last modified 2026-06-17.