{"data":{"id":"ac8a22a8-c4e1-4f09-8c7e-8ab1d5ae7be6","title":"CVE-2023-28858: redis-py before 4.5.3 leaves a connection open after canceling an async Redis command at an inopportune time, and can…","summary":"redis-py before 4.5.3 leaves a connection open after an async Redis command is canceled at an inopportune time. The connection can then send response data to the client of an unrelated request, in an off-by-one manner (CWE-193). NVD notes that 4.3.6, 4.4.3, and 4.5.3 were released to change the pipeline behavior, and points to CVE-2023-28859 for data leakage across AsyncIO connections in general.","solution":"Fixed in 4.3.6, 4.4.3, and 4.5.3 (the source notes these releases changed the behavior for pipeline operations).","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2023-28858","publishedAt":"2023-03-26T23:15:06.780Z","cveId":"CVE-2023-28858","cweIds":["CWE-193"],"cvssScore":"3.7","cvssSeverity":"low","severity":"low","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":["redis@>= 4.4.0, < 4.4.3 (fixed: 4.4.3)","redis@>= 4.5.0, < 4.5.3 (fixed: 4.5.3)","redis@>= 4.2.0, < 4.3.6 (fixed: 4.3.6)"],"affectedPackageNames":["redis"],"affectedPackageRefs":["pypi:redis"],"affectedVendors":["OpenAI"],"affectedVendorsRaw":["ChatGPT","redis-py"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"redis-py async connection leaks response data to unrelated requests","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.01018,"epssCheckedAt":"2026-11-04T12:08:35.127Z","kevDateAdded":null,"advisoryAliases":["GHSA-24wv-mv5m-xv4h"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:57:04.911Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2023-03-22T16:15:28.450Z","daysToFix":-4,"fixCheckedAt":"2026-10-29T21:47:07.602Z","capecIds":null,"crossRefCount":0,"attackSophistication":"advanced","impactType":["confidentiality"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.8,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"redis","fixedVersion":"4.5.3","matchedVersion":"4.5.3","fixReleasedAt":"2023-03-22T16:15:28.450Z","daysToFix":-4,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:47:07.452Z"},{"ecosystem":"pypi","name":"redis","fixedVersion":"4.4.3","matchedVersion":"4.4.3","fixReleasedAt":"2023-03-22T16:17:08.742Z","daysToFix":-4,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:47:07.452Z"},{"ecosystem":"pypi","name":"redis","fixedVersion":"4.3.6","matchedVersion":"4.3.6","fixReleasedAt":"2023-03-22T16:24:16.398Z","daysToFix":-4,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:47:07.452Z"}]}}