Skip to content
fr Sign in
7.1 High

CVE-2026-81934 Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS…

Description

Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the privileges of the Redis server.

Affected products and versions

Product Affected versions Fixed in
Redis 8.10 earliest → < 8.10.1 8.10.1
Redis 8.8 earliest → < 8.8.2 8.8.2
Redis 8.6 earliest → < 8.6.6 8.6.6
Redis 8.4 earliest → < 8.4.6 8.4.6
Redis 8.2 earliest → < 8.2.9 8.2.9
Redis 7.4 earliest → < 7.4.11 7.4.11
Redis 7.2 earliest → < 7.2.16 7.2.16
Redis 6.2 earliest → < 6.2.24 6.2.24
Redis Software (Enterprise) 8.2 earliest → < 8.2.0-46 8.2.0-46
Show the 3 other branches
Product Affected versions Fixed in
Redis Software (Enterprise) 8.0 earliest → < 8.0.20-96 8.0.20-96
Redis Software (Enterprise) 7.22 earliest → < 7.22.2-179 7.22.2-179
Redis Software (Enterprise) 7.8 earliest → < 7.8.6-303 7.8.6-303

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Redis

The 50 CVEs of Redis →
CVE-2026-72568 An out-of-bounds read vulnerability in Redis through 8.8.1 allows an adjacent unauthenticated attacker to cause denial… 7.1 High CVE-2026-66373 Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code… 7.5 High CVE-2026-25243 Redis is an in-memory data structure store 7.7 High CVE-2026-23631 Redis is an in-memory data structure store 6.1 Medium
Track this CVE