Description
Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the privileges of the Redis server.
Published: 2026-08-27
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the privileges of the Redis server.

Affected Systems

The flaw affects Redis, including both the open-source Redis distribution and Redis Software Enterprise releases. Versions prior to 6.2.24, 7.2.16, 7.4.11, 8.2.9, 8.4.6, 8.6.6, 8.8.2, and 8.10.1 are vulnerable. All releases in the 6.x, 7.x, and 8.x series before those patch levels are at risk.

Risk and Exploitability

With a CVSS score of 7.5 this vulnerability is considered high. Because the attack does not require authentication and can be launched from any network location that can reach the server's TLS port, the likelihood of exploitation in the wild is low, with an EPSS score of < 1% indicating a very low exploitation probability. The vulnerability is not currently included in the CISA KEV list, but the lack of KEV status does not reduce the risk to administrators.

Generated by OpenCVE AI on August 31, 2026 at 21:49 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to a fixed version: 6.2.24, 7.2.16, 7.4.11, 8.2.9, 8.4.6, 8.6.6, 8.8.2, or 8.10.1 or later.
  • If upgrading immediately is not possible, disable TLS support in the Redis configuration or eliminate the TLS port from the listening interfaces.
  • Restrict access to the Redis instance by limiting the TCP port exposed to trusted IP addresses only, and enable the built-in authentication mechanisms.

Generated by OpenCVE AI on August 31, 2026 at 21:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://github.com/redis/redis/commit/6d088c335d5c3ec49a6c28486140b498e70b7834 cve-icon cve-icon cve-icon
https://github.com/redis/redis/releases/tag/6.2.24 cve-icon cve-icon
https://github.com/redis/redis/releases/tag/7.2.16 cve-icon cve-icon
https://github.com/redis/redis/releases/tag/7.4.11 cve-icon cve-icon
https://github.com/redis/redis/releases/tag/8.10.1 cve-icon cve-icon
https://github.com/redis/redis/releases/tag/8.2.9 cve-icon cve-icon
https://github.com/redis/redis/releases/tag/8.4.6 cve-icon cve-icon
https://github.com/redis/redis/releases/tag/8.6.6 cve-icon cve-icon
https://github.com/redis/redis/releases/tag/8.8.2 cve-icon cve-icon
https://github.com/v12-security/pocs/tree/main/redis/server_ssl cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-81934 cve-icon
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-239-01.json cve-icon cve-icon
https://raw.githubusercontent.com/redis/redis/6.2/00-RELEASENOTES cve-icon cve-icon
https://raw.githubusercontent.com/redis/redis/7.2/00-RELEASENOTES cve-icon cve-icon
https://raw.githubusercontent.com/redis/redis/7.4/00-RELEASENOTES cve-icon cve-icon
https://raw.githubusercontent.com/redis/redis/8.10/00-RELEASENOTES cve-icon cve-icon cve-icon
https://raw.githubusercontent.com/redis/redis/8.2/00-RELEASENOTES cve-icon cve-icon cve-icon
https://raw.githubusercontent.com/redis/redis/8.4/00-RELEASENOTES cve-icon cve-icon cve-icon
https://raw.githubusercontent.com/redis/redis/8.6/00-RELEASENOTES cve-icon cve-icon cve-icon
https://raw.githubusercontent.com/redis/redis/8.8/00-RELEASENOTES cve-icon cve-icon cve-icon
https://redis.io/docs/latest/operate/rs/release-notes/rs-7-22-releases/rs-7-22-2-179/ cve-icon cve-icon
https://redis.io/docs/latest/operate/rs/release-notes/rs-7-8-releases/rs-7-8-6-303/ cve-icon cve-icon
https://redis.io/docs/latest/operate/rs/release-notes/rs-8-0-releases/rs-8-0-20-96/ cve-icon cve-icon
https://redis.io/docs/latest/operate/rs/release-notes/rs-8-2-releases/rs-8-2-0-46/ cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-81934 cve-icon cve-icon cve-icon
History

Wed, 02 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important

Mon, 31 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Description Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the privileges of the Redis server. Fixed in Redis 8.2.9, 8.4.6, 8.6.6, 8.8.2, and 8.10.1. Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the privileges of the Redis server.
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

 cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 7.5, 'vector': 'CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Fri, 28 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 28 Aug 2026 10:45:00 +0000

Type Values Removed Values Added
First Time appeared Redis
Redis redis
Vendors & Products Redis
Redis redis

Thu, 27 Aug 2026 18:00:00 +0000

Type Values Removed Values Added
Description Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the privileges of the Redis server. Fixed in Redis 8.2.9, 8.4.6, 8.6.6, 8.8.2, and 8.10.1.
Title Redis TLS pending-data list use-after-free
Weaknesses CWE-416
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Redis Redis
cve-icon MITRE

Status: PUBLISHED

Assigner: cisa-cg

Published:

Updated: 2026-08-31T19:17:53.121Z

Reserved: 2026-08-27T19:15:11.715Z

Link: CVE-2026-81934

cve-icon Vulnrichment

Updated: 2026-08-28T15:14:03.738Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-08-27T20:18:57.350

Modified: 2026-08-31T20:17:12.093

Link: CVE-2026-81934

cve-icon Redhat

Severity : Important

Publid Date: 2026-08-27T19:40:15Z

Links: CVE-2026-81934 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-31T22:00:06Z

Weaknesses