Skip to content
OpenAdvisories
High VA-26-239-01 1 CVE

Redis TLS pending-data list use-after-free

Published Aug 27, 2026 · Updated Aug 31, 2026 · Revision 2

Vendor: Redis Product: Redis Product: Software (Enterprise)

Summary

Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the privileges of the Redis server.

Vulnerabilities 1

  • High 7.1
    CVE-2026-81934

    Redis TLS pending-data list use-after-free

    Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the pri…

    Redis Redis Redis Software (Enterprise) redis Debian Ubuntu Azure Linux

Revision history

  1. #2.0.0

    Updated CVSS and Status

  2. #1.0.0

    Initial publication