CVE-2026-81934
CriticalCVSS 9.8Summary
Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the privileges of the Redis server. Fixed in Redis 8.2.9, 8.4.6, 8.6.6, 8.8.2, and 8.10.1.
Risk Assessment
The risk includes remote code execution with Redis server privileges, potentially leading to full server compromise and data breach.
Recommendation
Immediately upgrade Redis to one of the patched versions (8.2.9, 8.4.6, 8.6.6, 8.8.2, or 8.10.1) and enable TLS only if necessary.
Original NVD description (English source)
Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the privileges of the Redis server. Fixed in Redis 8.2.9, 8.4.6, 8.6.6, 8.8.2, and 8.10.1.