CVE-2023-28858

score

<0.1

cvss

3.7

epss

1.0%

published

2023-03-26

kev added

—

first seen

2026-10-21

redis-py before 4.5.3 contains a vulnerability caused by leaving a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request in an off-by-one manner, letting attackers impact data confidentiality, exploit requires specific timing conditions.