Security Advisory: CVE-2026-81934
Redis has identified and remediated a use-after-free vulnerability in TLS pending-data processing, which could allow an authenticated attacker to execute remote code under specific conditions. The vulnerability has been assigned a revised CVSS score of 7.5 (High) following further review.
Overview of CVE-2026-81934
Redis has addressed a use-after-free vulnerability in the TLS pending-data processing component. This flaw could potentially allow an authenticated attacker to execute arbitrary code under specific conditions. The vulnerability was initially assigned a CVSS score of 9.8 (Critical), but Redis has since requested a reassessment, resulting in a revised score of 7.5 (High) as of September 1, 2026.
Severity and Risk Assessment
Redis's internal evaluation of the vulnerability considers several factors, including the requirement for authenticated access, the complexity of exploitation, and the need for precise runtime conditions. The CVSS v4.0 score of 7.5 reflects these considerations, emphasizing that while the vulnerability is serious, it is not as broadly exploitable as initially indicated.
Impact and Potential Exploitation
The vulnerability arises from a flaw in the TLS pending-data processing logic. Under specific conditions, an authenticated attacker could exploit this flaw to execute remote code. However, successful exploitation would require coordinated TLS sessions, precise runtime conditions, and target-specific adaptations, which limit the likelihood of widespread exploitation.
Remediation and Protection Measures
Redis has released fixed versions of its open-source and software builds to address the vulnerability. Users are advised to upgrade to the latest fixed releases as soon as possible. Additional protective measures include restricting network access to trusted clients, enforcing strong authentication, and implementing least-privilege access controls. Redis should never be exposed directly to the internet.
Fixed Releases and Affected Systems
Fixed Redis Open Source releases include 8.10.1, 8.8.2, 8.6.6, 8.4.6, 8.2.9, 7.4.11, 7.2.16, and 6.2.24. Fixed Redis Software builds include 8.2.0-46, 8.0.20-96, 7.22.2-179, and 7.8.6-303. Redis Cloud Essentials subscriptions have been patched, while Redis Cloud Pro subscriptions are currently undergoing remediation.
Current Status and Next Steps
As of August 27, 2026, Redis is not aware of any active exploitation of this vulnerability in customer environments. The company has contacted the assigning organization to review the published CVSS score and will update this advisory if the public record changes. Customers requiring expedited maintenance should contact their Technical Account Manager.
Source: Redis. Analysis based on publicly available information; no hands-on testing is claimed.
