CVE-2026-62356

Redis is an advanced key-value store. It is often referred to as a dattructure server since keys can contain strings, hashes ,lists, sets anorted sets.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix missing credit release on failure in cifs_issue_read() Fix missing release of credits in the failure path in cifs_issue_read() lest retrying the subreq just overwrites the credits value.(CVE-2026-62356)

Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the privileges of the Redis server. Fixed in Redis 8.2.9, 8.4.6, 8.6.6, 8.8.2, and 8.10.1.(CVE-2026-81934)

A vulnerability, which was classified as critical, was found in Redis up to 8.8.1/8.9.x.CWE is classifying the issue as CWE-125. The product reads data past the end, or before the beginning, of the intended buffer.This is going to have an impact on confidentiality, integrity, and availability.Upgrading to version 8.10.0 eliminates this vulnerability.(CVE-2026-92925)

Redis is an advanced key-value store. It is often referred to as a dattructure server since keys can contain strings, hashes ,lists, sets anorted sets.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix missing credit release on failure in cifs_issue_read() Fix missing release of credits in the failure path in cifs_issue_read() lest retrying the subreq just overwrites the credits value.(CVE-2026-62356)

Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the privileges of the Redis server. Fixed in Redis 8.2.9, 8.4.6, 8.6.6, 8.8.2, and 8.10.1.(CVE-2026-81934)

A vulnerability, which was classified as critical, was found in Redis up to 8.8.1/8.9.x.CWE is classifying the issue as CWE-125. The product reads data past the end, or before the beginning, of the intended buffer.This is going to have an impact on confidentiality, integrity, and availability.Upgrading to version 8.10.0 eliminates this vulnerability.(CVE-2026-92925)

Redis is an advanced key-value store. It is often referred to as a dattructure server since keys can contain strings, hashes ,lists, sets anorted sets.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix missing credit release on failure in cifs_issue_read() Fix missing release of credits in the failure path in cifs_issue_read() lest retrying the subreq just overwrites the credits value.(CVE-2026-62356)

Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the privileges of the Redis server. Fixed in Redis 8.2.9, 8.4.6, 8.6.6, 8.8.2, and 8.10.1.(CVE-2026-81934)

A vulnerability, which was classified as critical, was found in Redis up to 8.8.1/8.9.x.CWE is classifying the issue as CWE-125. The product reads data past the end, or before the beginning, of the intended buffer.This is going to have an impact on confidentiality, integrity, and availability.Upgrading to version 8.10.0 eliminates this vulnerability.(CVE-2026-92925)

Redis is an advanced key-value store. It is often referred to as a dattructure server since keys can contain strings, hashes ,lists, sets anorted sets.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix missing credit release on failure in cifs_issue_read() Fix missing release of credits in the failure path in cifs_issue_read() lest retrying the subreq just overwrites the credits value.(CVE-2026-62356)

Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the privileges of the Redis server. Fixed in Redis 8.2.9, 8.4.6, 8.6.6, 8.8.2, and 8.10.1.(CVE-2026-81934)

A vulnerability, which was classified as critical, was found in Redis up to 8.8.1/8.9.x.CWE is classifying the issue as CWE-125. The product reads data past the end, or before the beginning, of the intended buffer.This is going to have an impact on confidentiality, integrity, and availability.Upgrading to version 8.10.0 eliminates this vulnerability.(CVE-2026-92925)

The updated package fixes security vulnerabilities, including: Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write. (CVE-2026-62356)

These are all security issues fixed in the redis-8.10.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for redis fixes the following issues:

Changes in redis:

• Update to 8.10.1

  Update urgency: SECURITY: There are security fixes in the release.

  • Security fixes
    • (CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write
    • Out-of-bounds access in TopK heap cleanup path (MOD-15410)
    • Use-after-free in the TLS pending-data list when a command closes another pending connection
    • A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution
    • Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access
    • Vector Sets: use-after-free when VREM mutates the HNSW graph while background VSIM threads are still running
    • Vector Sets: a negative hnsw_search() return was treated as a huge unsigned count, reading past the end of the result arrays
    • TLS client certificate authentication bypass: a Common Name containing an embedded NUL byte was truncated, allowing a client to authenticate as another (possibly privileged) ACL user
    • #15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

• Restrict the "modules" flavour to x86_64 and aarch64 -- RedisBloom and RedisTimeSeries abort on anything else with "only supports 64-bit architectures (x64, arm64v8)", redisjson's vendored redis-module is 64-bit only, and modules/common.mk maps no other architecture at all

• Update to 8.10.0

  Major changes compared to 8.8

  • Compact hashes - a new hash encoding that reduces memory usage by storing hash field names just once for keys that share a schema
  • New command: HIMPORT - high-throughput compact hash bulk insertion
  • TLS peer certificate-based server-to-server authentication
  • New commands: LMOVEM, BLMOVEM - move multiple elements between lists
  • New command: SUNIONCARD - get the cardinality of the union of multiple sets
  • New command: SDIFFCARD - get the cardinality of the difference between sets
  • New command: BACKUP - node-side implementation for backup and restore based on multi-part AOF (MP-AOF)
  • XREAD, XREADGROUP - new MAXCOUNT and MAXSIZE arguments to cap the cumulative reply entries and size
  • New command: FT.ALIASLIST - get all aliases for the index
  • Stemmer support for Malay and Tagalog languages
  • JSONPath extensions
  • New commands: TS.NRANGE, TS.NREVRANGE - Query a range across multiple time series; group results by timestamp
  • New command: TS.READ - optionally blocking read
  • New command: TS.QUERYLABELS - Get a list of labels and label-values
  • New command: TS.MRANGE, TS.MREVRANGE - new EXCLUDEEMPTY argument to exclude series with no reported samples
  • Performance improvements

• Update to 8.8.1 Security fixes

  • RedisBloom/RedisBloom#1044 Crafted RESTORE payloads in RedisBloom and TDigest may trigger out-of-bounds writes, potentially leading to remote code execution

• Update to 8.8.0

  • New data structure: Array (@antirez)
  • Subkey notification for hash fields - field-level notifications
  • INCREX: a window counter rate limiter combining INCR, INCRBY, INCRBYFLOAT, bounds, and expiration (@raffertyyu + Redis team)
  • XNACK: a new streams command - allow consumers to explicitly release pending messages
  • ZUNION, ZINTER, ZUNIONSTORE, ZINTERSTORE: new COUNT aggregator
  • JSON.SET: new FPHA argument to specify the FP type for homogeneous FP arrays
  • TS.RANGE, TS.REVRANGE, TS.MRANGE, TS.MREVRANGE: multiple aggregators in a single command
  • FT.HYBRID KNN clause: new argument to request fewer candidates per shard
  • FT.PROFILE HYBRID: profiling support for FT.HYBRID
  • Performance improvements

• Updated to 8.6.3 (boo#1264164 boo#1264165 boo#1264166…