Skip to content
Fencer Vulns
high 7.1

CVE-2026-81934 json

Redis TLS pending-data list use-after-free

published 2026-08-27 2 mo ago modified 2026-08-31 2 mo ago also EUVD-2026-67227

cvss
7.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 41%
public exploits
0
none known

Summary

Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the privileges of the Redis server.

Patch / fix

  • Redis Redis 6.2.24, 7.2.16, 7.4.11, 8.2.9, 8.4.6, 8.6.6, 8.8.2, 8.10.1
  • Redis Redis Software (Enterprise) 7.8.6-303, 7.22.2-179, 8.0.20-96, 8.2.0-46
  • redis Debian 12 5:7.0.15-1~deb12u10
  • redis Debian 13 5:8.0.2-3+deb13u3
  • redis Debian 14 5:8.0.6-3

debian advisories DEBIAN-CVE-2026-81934

  • redis Ubuntu 22.04 LTS 5:6.0.16-1ubuntu1.2
  • redis Ubuntu 24.04 LTS 5:7.0.15-1ubuntu0.24.04.5
  • redis Ubuntu 26.04 LTS 5:8.0.5-1ubuntu0.1

ubuntu advisories UBUNTU-CVE-2026-81934

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • redis RHEL 9 7.2.16-1.module+el9.8.0+24745+654dcf03
  • redis RHEL 9 6.2.24-1.el9_8
  • redis RHEL 8 6.2.24-1.module+el8.10.0+24746+7b800ac5
  • redis RHEL 9.2 E4S 6.2.7-1.el9_2.7
  • redis RHEL 9.4 E4S 6.2.7-1.el9_4.7
  • redis RHEL 8.4 EUS_LONG_LIFE, RHEL 8.4 AUS 6.0.9-5.module+el8.4.0+24914+3cb9e211.7
  • redis RHEL 8.8 TUS, RHEL 8.8 E4S 6.2.7-1.module+el8.8.0+24912+36dda224.8
  • redis RHEL 8.6 EUS_LONG_LIFE, RHEL 8.6 AUS 6.0.9-5.module+el8.6.0+24913+caade4b4.8

red hat advisories RHSA-2026:69862RHSA-2026:69861RHSA-2026:69542RHSA-2026:69533RHSA-2026:69534RHSA-2026:69521

  • redis7 SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE High Performance Computing 15 SP5-LTSS +1 more 7.0.8-150500.3.37.1
  • redis SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +5 more 6.2.6-150400.3.52.1
  • redis7 SLES for SAP 15 SP6, SLES 15 SP6-LTSS 7.0.8-150600.8.31.1
  • redis SLES for SAP 15 SP6, SLES 15 SP6-LTSS 7.2.4-150600.3.30.1

suse advisories SUSE-SU-2026:4069-1SUSE-SU-2026:4068-1SUSE-SU-2026:3991-1SUSE-SU-2026:3990-1

  • redis AlmaLinux 8 6.2.24-1.module_el8.10.0+4271+7f8f19af
  • redis AlmaLinux 9 6.2.24-1.el9_8

almalinux advisories ALSA-2026:64823ALSA-2026:64824

  • redis Rocky Linux 9 6.2.24-1.el9_8
  • redis Rocky Linux 9 7.2.16-1.module+el9.8.0+40315+e15874a8
  • redis Rocky Linux 8 6.2.24-1.module+el8.10.0+40313+282db117

rocky linux advisories RLSA-2026:64824RLSA-2026:65120RLSA-2026:64823

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-81934 updated cvss 7.5

redis: Redis: Arbitrary code execution via TLS pending-data list use-after-free

  • Red Hat Enterprise Linux AppStream (v. 8) redis 6.2.24-1.module+el8.10.0+24746+7b800ac5
    fixed: vendor fix RHSA-2026:64823
  • Red Hat Enterprise Linux AppStream (v. 9) redis 6.2.24-1.el9_8, redis 7.2.16-1.module+el9.8.0+24745+654dcf03
    fixed: vendor fix RHSA-2026:64824
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) redis 6.0.9-5.module+el8.4.0+24914+3cb9e211.7
    fixed: vendor fix RHSA-2026:69542
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) redis 6.0.9-5.module+el8.6.0+24913+caade4b4.8
    fixed: vendor fix RHSA-2026:69534
  • Red Hat Enterprise Linux AppStream E4S (v.8.8) redis 6.2.7-1.module+el8.8.0+24912+36dda224.8
    fixed: vendor fix RHSA-2026:69533
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) redis 6.2.7-1.el9_2.7
    fixed: vendor fix RHSA-2026:69862
  • Red Hat Enterprise Linux AppStream E4S (v.9.4) redis 6.2.7-1.el9_4.7, redis 7.0.12-2.module+el9.4.0+24911+6845972a.9
    fixed: vendor fix RHSA-2026:69861
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) redis 6.2.24-1.el9_6, redis 7.2.16-1.module+el9.6.0+24910+8b24772d
    fixed: vendor fix RHSA-2026:67461
show 4 more
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) redis 6.0.9-5.module+el8.4.0+24914+3cb9e211.7
    fixed: vendor fix RHSA-2026:69542
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) redis 6.0.9-5.module+el8.6.0+24913+caade4b4.8
    fixed: vendor fix RHSA-2026:69534
  • Red Hat Enterprise Linux AppStream TUS (v.8.8) redis 6.2.7-1.module+el8.8.0+24912+36dda224.8
    fixed: vendor fix RHSA-2026:69533
  • Red Hat Hardened Images boost, valkey
    not affected: component not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa vex VA-26-239-01 updated cvss 7.1

Redis TLS pending-data list use-after-free

  • Redis <8.8.2, <8.2.9, <8.4.6, <8.6.6
    affected: vendor fix github.com
  • Redis Software (Enterprise) <8.2.0-46, <8.0.20-96, <7.22.2-179, <7.8.6-303
    affected: vendor fix redis.io
  • Redis 8.2.9, 8.4.6, 8.6.6, 8.8.2
    fixed: vendor fix github.com
  • Redis Software (Enterprise) 8.2.0-46, 8.0.20-96, 7.22.2-179, 7.8.6-303
    fixed: vendor fix redis.io

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
2 mo ago

Exploit prediction

0.48% chance of exploitation in the next 30 days, higher than 41% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/v12-security/pocs/tree/main/redis/server_ssl referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.1 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA 4.0 7.5 CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA 4.0 7.5 CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

  • Redis Redis
  • Redis Redis Software (Enterprise)

Classification

Weakness
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.