Red Hat Security Advisory: redis:7 security update

Fixed packages 5

Vulnerabilities 4

• High 7.5
  CVE-2026-66373

  Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code executi…

  Redis Redis redis redis Debian Ubuntu Azure Linux
  Jul 25, 2026
• High 7.1
  CVE-2026-72568 Rejected

  Red Hat CNA-LR concluded that this CVE is not valid.

  Aug 10, 2026
• High 7.1
  CVE-2026-81934

  Redis TLS pending-data list use-after-free

  Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the pri…

  Redis Redis Redis Software (Enterprise) redis Debian Ubuntu Azure Linux
  Aug 27, 2026
• High 7.1
  CVE-2026-92925

  Redis: redis: out-of-bounds read via crafted cluster bus packets

  A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-carrying extensions for null-termination. This oversight allows a remote attacker to craft a malicious…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 10 Linux Debian Ubuntu
  Sep 17, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2506985
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2513105
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2525226
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2535971
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_69520.json
• report
  https://access.redhat.com/security/cve/CVE-2026-66373
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-66373
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-66373
• article
  https://github.com/berabuddies/redis-poc
• article
  https://github.com/redis/redis/compare/8.6.4...8.8.0
• article
  https://github.com/redis/redis/pull/15081
• article
  https://news.ycombinator.com/item?id=49024938
• article
  https://x.com/Fried_rice/status/2080059356322918777
• report
  https://access.redhat.com/security/cve/CVE-2026-72568
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-72568
• report
  https://access.redhat.com/security/cve/CVE-2026-81934
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-81934
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-81934
• article
  https://github.com/redis/redis/commit/6d088c335d5c3ec49a6c28486140b498e70b7834
• article
  https://github.com/v12-security/pocs/tree/main/redis/server_ssl
• article
  https://raw.githubusercontent.com/redis/redis/8.10/00-RELEASENOTES
• article
  https://raw.githubusercontent.com/redis/redis/8.2/00-RELEASENOTES
• article
  https://raw.githubusercontent.com/redis/redis/8.4/00-RELEASENOTES
• article
  https://raw.githubusercontent.com/redis/redis/8.6/00-RELEASENOTES
• article
  https://raw.githubusercontent.com/redis/redis/8.8/00-RELEASENOTES
• report
  https://access.redhat.com/security/cve/CVE-2026-92925
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-92925
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-92925
• article
  https://github.com/redis/redis/commit/37894faeea11e2db28b9fc2af378a762d2c36523
• article
  https://github.com/redis/redis/pull/15263
• article
  https://github.com/redis/redis/releases/tag/8.10.0