Vulnerability Reportredis:8.4.8-alpine

redis:8.4.8-alpine3.22redis:8.4.8-alpine

digestsha256:d78b2cc0b2433837395263cb86d5ce3830f492201525b0fd148496706fc8fe8c

Executive Summary

Last scanned: Oct 27, 2026

Threat ScoreDANGEROUS• Redis 8.4.8 listens on port 6379 with no password and protected mode disabled, so any client that can reach the port is effectively authenticated.• CVE-2026-23479 and CVE-2026-25243 are severity 8.8 remote code execution flaws reachable in default operation.• Scan stats show 3 exposed vulnerabilities, 2 at severity 7.0 or higher, and no post-exploit-only findings.• CVE-2026-23631 (severity 6.48) only applies in a master-replica setup where replica-read-only is disabled.• The container runs as root by default, which raises the impact of any code execution.

85/100DANGEROUS

ReputationOFFICIAL• Official Docker Hub Image• Pinned by digest (Immutable)

TRUSTED

This image poses a critical security risk and must not be used in production, especially as an internet-facing service. An attacker who reaches port 6379 could execute code on the server, corrupt memory, or disrupt the cache service, because no password is set and protected mode is off. Note: CVE-2026-23631 only applies if a master-replica setup with writable replicas is used. Upgrading Redis to 8.6.3 or later addresses the affected versions of CVE-2026-23479.

Vulnerabilities

Vulnerability Log

3 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2026-23479	HIGH8.8	redis 8.4.8 No fix yet	1.7% Low-Moderate Risk	Directly ExposedContext importance: HIGH
CVE-2026-25243	HIGH8.8	redis 8.4.8 No fix yet	4.0% Low-Moderate Risk	Directly ExposedContext importance: HIGH
CVE-2026-23631	MEDIUM6.48	redis 8.4.8 No fix yet	3.1% Low-Moderate Risk	Directly ExposedContext importance: MEDIUM

Reachability analysis

Which CVEs are actually reachable — is the vulnerable code even linked and callable.

Locked

Runtime verification

Live-container probes: default user, writable paths, capabilities, exposed ports.

Locked

Supply chain analysis

Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.

Locked

Hardening recommendations

A step-by-step hardened build plan, with parity tests proving nothing breaks.

Locked

Want to check another image? Run a full scan with the Docker Security Scanner.