PyPI/redis CVE-2023-28859: unknown, EPSS 1.03%

redis-py through 4.5.3 leaves a connection open after canceling an async Redis command at an inopportune time (in the case of a non-pipeline operation), and can send response data to the client of an

Action: Upgrade redis to 4.4.4 or later.

pip install redis==4.4.4

pip install redis==4.5.4

Affected

Fixed versions

Sources

• osv: PYSEC-2023-46
• https://github.com/redis/redis-py/pull/2641
• https://github.com/redis/redis-py/issues/2665
• https://github.com/advisories/GHSA-8fww-64cx-x8p5

CVE-2023-28859 · published 2023-03-26T19:15:00Z · modified 2026-06-10T17:02:35.124062693Z · JSON