CVE-2026-81934 — Redis TLS pending-data list use-after-free

Affected: Redis, Redis Software (Enterprise)

Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the privileges of the Redis server.

USN-8866-1 — redis vulnerabilities

Affected: Ubuntu:22.04:LTS: redis, Ubuntu:24.04:LTS: redis, Ubuntu:26.04:LTS: redis

It was discovered that Redis did not properly manage memory when handling the TLS pending-data list. A remote attacker could possibly use this issue to execute arbitrary code. (CVE-2026-81934)

It was discovered that Redis incorrectly handled certain inputs when processing cluster bus packets. A remote attacker could possibly use this issue to expose sensitive information or cause a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-92925)

Most recent entries from all

CVE-2026-81934 — Redis TLS pending-data list use-after-free

USN-8866-1 — redis vulnerabilities