CVE-2026-81934

Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the privileges of the Redis server.

Redis is an advanced key-value store. It is often referred to as a dattructure server since keys can contain strings, hashes ,lists, sets anorted sets.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix missing credit release on failure in cifs_issue_read() Fix missing release of credits in the failure path in cifs_issue_read() lest retrying the subreq just overwrites the credits value.(CVE-2026-62356)

Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the privileges of the Redis server. Fixed in Redis 8.2.9, 8.4.6, 8.6.6, 8.8.2, and 8.10.1.(CVE-2026-81934)

A vulnerability, which was classified as critical, was found in Redis up to 8.8.1/8.9.x.CWE is classifying the issue as CWE-125. The product reads data past the end, or before the beginning, of the intended buffer.This is going to have an impact on confidentiality, integrity, and availability.Upgrading to version 8.10.0 eliminates this vulnerability.(CVE-2026-92925)

Redis is an advanced key-value store. It is often referred to as a dattructure server since keys can contain strings, hashes ,lists, sets anorted sets.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix missing credit release on failure in cifs_issue_read() Fix missing release of credits in the failure path in cifs_issue_read() lest retrying the subreq just overwrites the credits value.(CVE-2026-62356)

Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the privileges of the Redis server. Fixed in Redis 8.2.9, 8.4.6, 8.6.6, 8.8.2, and 8.10.1.(CVE-2026-81934)

A vulnerability, which was classified as critical, was found in Redis up to 8.8.1/8.9.x.CWE is classifying the issue as CWE-125. The product reads data past the end, or before the beginning, of the intended buffer.This is going to have an impact on confidentiality, integrity, and availability.Upgrading to version 8.10.0 eliminates this vulnerability.(CVE-2026-92925)

Redis is an advanced key-value store. It is often referred to as a dattructure server since keys can contain strings, hashes ,lists, sets anorted sets.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix missing credit release on failure in cifs_issue_read() Fix missing release of credits in the failure path in cifs_issue_read() lest retrying the subreq just overwrites the credits value.(CVE-2026-62356)

Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the privileges of the Redis server. Fixed in Redis 8.2.9, 8.4.6, 8.6.6, 8.8.2, and 8.10.1.(CVE-2026-81934)

A vulnerability, which was classified as critical, was found in Redis up to 8.8.1/8.9.x.CWE is classifying the issue as CWE-125. The product reads data past the end, or before the beginning, of the intended buffer.This is going to have an impact on confidentiality, integrity, and availability.Upgrading to version 8.10.0 eliminates this vulnerability.(CVE-2026-92925)

Redis is an advanced key-value store. It is often referred to as a dattructure server since keys can contain strings, hashes ,lists, sets anorted sets.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix missing credit release on failure in cifs_issue_read() Fix missing release of credits in the failure path in cifs_issue_read() lest retrying the subreq just overwrites the credits value.(CVE-2026-62356)

Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the privileges of the Redis server. Fixed in Redis 8.2.9, 8.4.6, 8.6.6, 8.8.2, and 8.10.1.(CVE-2026-81934)

A vulnerability, which was classified as critical, was found in Redis up to 8.8.1/8.9.x.CWE is classifying the issue as CWE-125. The product reads data past the end, or before the beginning, of the intended buffer.This is going to have an impact on confidentiality, integrity, and availability.Upgrading to version 8.10.0 eliminates this vulnerability.(CVE-2026-92925)

Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, or by appending each command to a log.

Security Fix(es):

• redis: Redis: Remote Code Execution via specially crafted RESTORE payload (CVE-2026-66373)

• redis: Redis: Arbitrary code execution via TLS pending-data list use-after-free (CVE-2026-81934)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, or by appending each command to a log.

Security Fix(es):

• redis: Redis: Remote Code Execution via specially crafted RESTORE payload (CVE-2026-66373)

• redis: Redis: Arbitrary code execution via TLS pending-data list use-after-free (CVE-2026-81934)

Bug Fix(es) and Enhancement(s):

• segfault because of Unsupported system page size (jemalloc) (JIRA:Rocky Linux-180910)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, or by appending each command to a log.

Security Fix(es):

• redis: Redis: Remote Code Execution via specially crafted RESTORE payload (CVE-2026-66373)

• redis: Redis: Denial of Service via Out-of-Bounds Read in Cluster Bus (CVE-2026-72568)

• redis: Redis: Arbitrary code execution via TLS pending-data list use-after-free (CVE-2026-81934)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the privileges of the Redis server.

Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, or by appending each command to a log.

Security Fix(es):

• redis: Redis: Remote Code Execution via specially crafted RESTORE payload (CVE-2026-66373)
• redis: Redis: Arbitrary code execution via TLS pending-data list use-after-free (CVE-2026-81934)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, or by appending each command to a log.

Security Fix(es):

• redis: Redis: Remote Code Execution via specially crafted RESTORE payload (CVE-2026-66373)
• redis: Redis: Arbitrary code execution via TLS pending-data list use-after-free (CVE-2026-81934)

Bug Fix(es) and Enhancement(s):

• segfault because of Unsupported system page size (jemalloc) (JIRA:AlmaLinux-180910)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the privileges of the Redis server.

• CVE-2026-81934: fix use-after-free in tlsProcessPendingData() by detaching each pending TLS connection from the head of pending_list before invoking its event handler, instead of iterating with a listIter whose pre-cached next pointer could dangle when the handler closed another connection

• CVE-2026-81934: fix use-after-free in the TLS pending-data list by detaching each connection from the list head before running its read handler

This update for redis fixes the following issue:

• CVE-2026-81934: TLS pending-data handling can cause use-after-free (bsc#1277794).

This update for redis7 fixes the following issue:

• CVE-2026-81934: TLS pending-data handling can cause use-after-free (bsc#1277794).

This update for redis fixes the following issue:

• CVE-2026-81934: TLS pending-data handling can cause use-after-free (bsc#1277794).

This update for redis7 fixes the following issue:

• CVE-2026-81934: TLS pending-data handling can cause use-after-free (bsc#1277794).

It was discovered that Redis did not properly manage memory when handling the TLS pending-data list. A remote attacker could possibly use this issue to execute arbitrary code. (CVE-2026-81934)

It was discovered that Redis incorrectly handled certain inputs when processing cluster bus packets. A remote attacker could possibly use this issue to expose sensitive information or cause a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-92925)