p PatchFirst

CVE-2026-81934

CVE-2026-81934 · Redis TLS pending-data list use-after-free

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the privileges of the Redis server.

CVSS 7.5 · High · EPSS 0.5% · Fix available

Published
Updated

Stack: system · database

Affected products and versions

  • redis

    Versions
    • 8.2.9: Not affected
    • 8.4.6: Not affected
    • 8.6.6: Not affected
    • 8.8.2: Not affected
    • 8.10.1: Not affected
    • 7.4.11: Not affected
    • 6.2.24: Not affected
    • 7.2.16: Not affected
    • ≥ 0, < 8.8.2: Affected (custom)
    • ≥ 0, < 8.2.9: Affected (custom)
    • ≥ 0, < 8.4.6: Affected (custom)
    • ≥ 0, < 8.6.6: Affected (custom)
    • ≥ 0, < 8.10.1: Affected (custom)
    • ≥ 0, < 7.4.11: Affected (custom)
    • ≥ 0, < 6.2.24: Affected (custom)
    • ≥ 0, < 7.2.16: Affected (custom)

    Update to 8.8.2

  • redis software (enterprise)

    Versions
    • 8.2.0-46: Not affected
    • 8.0.20-96: Not affected
    • 7.22.2-179: Not affected
    • 7.8.6-303: Not affected
    • ≥ 0, < 8.2.0-46: Affected (custom)
    • ≥ 0, < 8.0.20-96: Affected (custom)
    • ≥ 0, < 7.22.2-179: Affected (custom)
    • ≥ 0, < 7.8.6-303: Affected (custom)

    Update to 8.2.0-46

  • redis Debian:12

    Versions
    • 5:7.0.11-1
    • 5:7.0.11-1+deb12u1
    • 5:7.0.12-1
    • 5:7.0.12-2
    • 5:7.0.13-1
    • 5:7.0.13-2
    • 5:7.0.14-1
    • 5:7.0.14-2
    • 5:7.0.15-1~deb12u1
    • 5:7.0.15-1~deb12u2
    • 5:7.0.15-1~deb12u3
    • 5:7.0.15-1~deb12u4
    • 5:7.0.15-1~deb12u5
    • 5:7.0.15-1~deb12u6
    • 5:7.0.15-1~deb12u7
    • 5:7.0.15-1~deb12u8
    • 5:7.0.15-1~deb12u9
    Affected ranges
    • ECOSYSTEM: < 5:7.0.15-1~deb12u10

    Update to 5:7.0.15-1~deb12u10

  • redis Debian:13

    Versions
    • 5:8.0.2-3
    • 5:8.0.2-3+deb13u1
    • 5:8.0.2-3+deb13u2
    Affected ranges
    • ECOSYSTEM: < 5:8.0.2-3+deb13u3

    Update to 5:8.0.2-3+deb13u3

  • redis Debian:14

    Versions
    • 5:8.0.2-3
    • 5:8.0.4-1
    • 5:8.0.5-1
    • 5:8.0.6-1
    • 5:8.0.6-2
    Affected ranges
    • ECOSYSTEM: < 5:8.0.6-3

    Update to 5:8.0.6-3

  • redis Ubuntu:22.04:LTS

    Versions
    • 5:6.0.15-1
    • 5:6.0.16-1
    • 5:6.0.16-1build1
    • 5:6.0.16-1ubuntu1
    • 5:6.0.16-1ubuntu1.1
    Affected ranges
    • ECOSYSTEM: < 5:6.0.16-1ubuntu1.2

    Update to 5:6.0.16-1ubuntu1.2

  • redis Ubuntu:24.04:LTS

    Versions
    • 5:7.0.12-1
    • 5:7.0.14-1
    • 5:7.0.14-2
    • 5:7.0.15-1
    • 5:7.0.15-1build1
    • 5:7.0.15-1build2
    • 5:7.0.15-1ubuntu0.24.04.1
    • 5:7.0.15-1ubuntu0.24.04.2
    • 5:7.0.15-1ubuntu0.24.04.3
    • 5:7.0.15-1ubuntu0.24.04.4
    Affected ranges
    • ECOSYSTEM: < 5:7.0.15-1ubuntu0.24.04.5

    Update to 5:7.0.15-1ubuntu0.24.04.5

  • redis Ubuntu:26.04:LTS

    Versions
    • 5:8.0.2-3build1
    • 5:8.0.2-3ubuntu0.25.10.1
    • 5:8.0.5-1
    Affected ranges
    • ECOSYSTEM: < 5:8.0.5-1ubuntu0.1

    Update to 5:8.0.5-1ubuntu0.1

Original sources

Check your server →