CVE-2023-28859

redis-py before 4.4.4 and 4.5.x before 4.5.4 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request. (This could, for example, happen for a non-pipeline operation.) NOTE: the solutions for CVE-2023-28859 address data leakage across AsyncIO connections in general.

• CWE-459

• https://github.com/redis/redis-py/issues/2665Issue Tracking, Patch, Vendor Advisory
• https://github.com/redis/redis-py/pull/2641Issue Tracking, Patch
• https://github.com/redis/redis-py/pull/2666Release Notes
• https://github.com/redis/redis-py/releases/tag/v4.4.4Release Notes
• https://github.com/redis/redis-py/releases/tag/v4.5.4Release Notes
• https://github.com/redis/redis-py/issues/2665Issue Tracking, Patch, Vendor Advisory
• https://github.com/redis/redis-py/pull/2641Issue Tracking, Patch
• https://github.com/redis/redis-py/pull/2666Release Notes
• https://github.com/redis/redis-py/releases/tag/v4.4.4Release Notes
• https://github.com/redis/redis-py/releases/tag/v4.5.4Release Notes

Published

Mar 26, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-28853Mastodon is a free, open-source social network server based …6.5
• CVE-2023-28854nophp is a PHP web framework. Prior to version 0.0.1, nophp …8.8
• CVE-2023-28855Fields is a GLPI plugin that allows users to add custom fiel…6.5
• CVE-2023-28856Redis is an open source, in-memory database that persists on…6.5
• CVE-2023-28857Apereo CAS is an open source multilingual single sign-on sol…7.5
• CVE-2023-28858redis-py before 4.5.3 leaves a connection open after canceli…3.7
• CVE-2023-2886Missing Origin Validation in WebSockets vulnerability in CBO…4.3
• CVE-2023-28862An issue was discovered in LemonLDAP::NG before 2.16.1. Weak…9.8
• CVE-2023-28863AMI MegaRAC SPx12 and SPx13 devices have Insufficient Verifi…9.1
• CVE-2023-28864Progress Chef Infra Server before 15.7 allows a local attack…5.5
• CVE-2023-28865Diebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR…6.6
• CVE-2023-28866In the Linux kernel through 6.2.8, net/bluetooth/hci_sync.c …5.3