rewindex

RewindexCVEsRedis

CVE-2026-81934: Redis TLS pending-data list use-after-free

High · CVSS 7.1 (CVSS 3.1)EPSS 0.48%, 41th percentilePublished Updated Assigner: cisa-cg

Description

Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the privileges of the Redis server.

Vector CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H · CWE-416

Tracked companies

Redis

Mapped from the CVE’s affected-product data, NVD CPE matches, vendor advisories or package feeds. A mapping means the vendor’s software is named, not that its hosted service was exposed.

Status incidents that name it

No tracked status incident names this CVE.

Affected vendors and products

Redis: RedisRedis: Redis Software (Enterprise)

References

All CVEsMarkdownJSON