{"id":"CVE-2026-81934","state":"PUBLISHED","title":"Redis TLS pending-data list use-after-free","description":"Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the privileges of the Redis server.","publishedAt":"2026-08-27T19:40:15.141Z","updatedAt":"2026-08-31T19:17:53.121Z","severity":{"score":7.5,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"cisa-cg"},"assigner":"cisa-cg","products":["Redis Redis","Redis Redis Software (Enterprise)"],"affected":[{"vendor":"Redis","product":"Redis","defaultStatus":"unknown","versions":[{"version":"8.2.9","status":"unaffected"},{"version":"8.4.6","status":"unaffected"},{"version":"8.6.6","status":"unaffected"},{"version":"8.8.2","status":"unaffected"},{"version":"8.10.1","status":"unaffected"},{"version":"7.4.11","status":"unaffected"},{"version":"6.2.24","status":"unaffected"},{"version":"7.2.16","status":"unaffected"},{"version":"0","status":"affected","lessThan":"8.8.2","versionType":"custom"},{"version":"0","status":"affected","lessThan":"8.2.9","versionType":"custom"},{"version":"0","status":"affected","lessThan":"8.4.6","versionType":"custom"},{"version":"0","status":"affected","lessThan":"8.6.6","versionType":"custom"},{"version":"0","status":"affected","lessThan":"8.10.1","versionType":"custom"},{"version":"0","status":"affected","lessThan":"7.4.11","versionType":"custom"},{"version":"0","status":"affected","lessThan":"6.2.24","versionType":"custom"},{"version":"0","status":"affected","lessThan":"7.2.16","versionType":"custom"}]},{"vendor":"Redis","product":"Redis Software (Enterprise)","defaultStatus":"unknown","versions":[{"version":"8.2.0-46","status":"unaffected"},{"version":"8.0.20-96","status":"unaffected"},{"version":"7.22.2-179","status":"unaffected"},{"version":"7.8.6-303","status":"unaffected"},{"version":"0","status":"affected","lessThan":"8.2.0-46","versionType":"custom"},{"version":"0","status":"affected","lessThan":"8.0.20-96","versionType":"custom"},{"version":"0","status":"affected","lessThan":"7.22.2-179","versionType":"custom"},{"version":"0","status":"affected","lessThan":"7.8.6-303","versionType":"custom"}]}],"references":["https://github.com/redis/redis/commit/6d088c335d5c3ec49a6c28486140b498e70b7834","https://github.com/v12-security/pocs/tree/main/redis/server_ssl","https://raw.githubusercontent.com/redis/redis/8.2/00-RELEASENOTES","https://raw.githubusercontent.com/redis/redis/8.4/00-RELEASENOTES","https://raw.githubusercontent.com/redis/redis/8.6/00-RELEASENOTES","https://raw.githubusercontent.com/redis/redis/8.8/00-RELEASENOTES","https://raw.githubusercontent.com/redis/redis/8.10/00-RELEASENOTES","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-239-01.json","https://www.cve.org/CVERecord?id=CVE-2026-81934","https://github.com/redis/redis/releases/tag/6.2.24","https://github.com/redis/redis/releases/tag/7.2.16","https://github.com/redis/redis/releases/tag/7.4.11","https://github.com/redis/redis/releases/tag/8.4.6","https://github.com/redis/redis/releases/tag/8.2.9","https://github.com/redis/redis/releases/tag/8.6.6","https://github.com/redis/redis/releases/tag/8.8.2","https://github.com/redis/redis/releases/tag/8.10.1","https://redis.io/docs/latest/operate/rs/release-notes/rs-8-2-releases/rs-8-2-0-46/","https://redis.io/docs/latest/operate/rs/release-notes/rs-8-0-releases/rs-8-0-20-96/","https://redis.io/docs/latest/operate/rs/release-notes/rs-7-22-releases/rs-7-22-2-179/","https://redis.io/docs/latest/operate/rs/release-notes/rs-7-8-releases/rs-7-8-6-303/","https://raw.githubusercontent.com/redis/redis/7.4/00-RELEASENOTES","https://raw.githubusercontent.com/redis/redis/7.2/00-RELEASENOTES","https://raw.githubusercontent.com/redis/redis/6.2/00-RELEASENOTES"],"weaknesses":["CWE-416"],"ingestedAt":"2026-10-29T20:13:15.269Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/81xxx/CVE-2026-81934.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-81934","state":"PUBLISHED","datePublished":"2026-08-27T19:40:15.141Z","dateUpdated":"2026-08-31T19:17:53.121Z","assignerShortName":"cisa-cg","assignerOrgId":"9119a7d8-5eab-497f-8521-727c672e3725","dateReserved":"2026-08-27T19:15:11.715Z"},"containers":{"cna":{"title":"Redis TLS pending-data list use-after-free","descriptions":[{"lang":"en","value":"Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the privileges of the Redis server."}],"affected":[{"vendor":"Redis","product":"Redis","defaultStatus":"unknown","versions":[{"version":"8.2.9","status":"unaffected"},{"version":"8.4.6","status":"unaffected"},{"version":"8.6.6","status":"unaffected"},{"version":"8.8.2","status":"unaffected"},{"version":"8.10.1","status":"unaffected"},{"version":"7.4.11","status":"unaffected"},{"version":"6.2.24","status":"unaffected"},{"version":"7.2.16","status":"unaffected"},{"version":"0","status":"affected","lessThan":"8.8.2","versionType":"custom"},{"version":"0","status":"affected","lessThan":"8.2.9","versionType":"custom"},{"version":"0","status":"affected","lessThan":"8.4.6","versionType":"custom"},{"version":"0","status":"affected","lessThan":"8.6.6","versionType":"custom"},{"version":"0","status":"affected","lessThan":"8.10.1","versionType":"custom"},{"version":"0","status":"affected","lessThan":"7.4.11","versionType":"custom"},{"version":"0","status":"affected","lessThan":"6.2.24","versionType":"custom"},{"version":"0","status":"affected","lessThan":"7.2.16","versionType":"custom"}]},{"vendor":"Redis","product":"Redis Software (Enterprise)","defaultStatus":"unknown","versions":[{"version":"8.2.0-46","status":"unaffected"},{"version":"8.0.20-96","status":"unaffected"},{"version":"7.22.2-179","status":"unaffected"},{"version":"7.8.6-303","status":"unaffected"},{"version":"0","status":"affected","lessThan":"8.2.0-46","versionType":"custom"},{"version":"0","status":"affected","lessThan":"8.0.20-96","versionType":"custom"},{"version":"0","status":"affected","lessThan":"7.22.2-179","versionType":"custom"},{"version":"0","status":"affected","lessThan":"7.8.6-303","versionType":"custom"}]}],"references":[{"url":"https://github.com/redis/redis/commit/6d088c335d5c3ec49a6c28486140b498e70b7834","name":"url","tags":["patch"]},{"url":"https://github.com/v12-security/pocs/tree/main/redis/server_ssl","name":"url","tags":["exploit"]},{"url":"https://raw.githubusercontent.com/redis/redis/8.2/00-RELEASENOTES","name":"url","tags":["release-notes"]},{"url":"https://raw.githubusercontent.com/redis/redis/8.4/00-RELEASENOTES","name":"url","tags":["release-notes"]},{"url":"https://raw.githubusercontent.com/redis/redis/8.6/00-RELEASENOTES","name":"url","tags":["release-notes"]},{"url":"https://raw.githubusercontent.com/redis/redis/8.8/00-RELEASENOTES","name":"url","tags":["release-notes"]},{"url":"https://raw.githubusercontent.com/redis/redis/8.10/00-RELEASENOTES","name":"url","tags":["release-notes"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-239-01.json","name":"url","tags":["third-party-advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-81934","name":"url","tags":["vdb-entry"]},{"url":"https://github.com/redis/redis/releases/tag/6.2.24","name":"url","tags":["release-notes"]},{"url":"https://github.com/redis/redis/releases/tag/7.2.16","name":"url","tags":["release-notes"]},{"url":"https://github.com/redis/redis/releases/tag/7.4.11","name":"url","tags":["release-notes"]},{"url":"https://github.com/redis/redis/releases/tag/8.4.6","name":"url","tags":["release-notes"]},{"url":"https://github.com/redis/redis/releases/tag/8.2.9","name":"url","tags":["release-notes"]},{"url":"https://github.com/redis/redis/releases/tag/8.6.6","name":"url","tags":["release-notes"]},{"url":"https://github.com/redis/redis/releases/tag/8.8.2","name":"url","tags":["release-notes"]},{"url":"https://github.com/redis/redis/releases/tag/8.10.1","name":"url","tags":["release-notes"]},{"url":"https://redis.io/docs/latest/operate/rs/release-notes/rs-8-2-releases/rs-8-2-0-46/","name":"url","tags":["release-notes"]},{"url":"https://redis.io/docs/latest/operate/rs/release-notes/rs-8-0-releases/rs-8-0-20-96/","name":"url","tags":["release-notes"]},{"url":"https://redis.io/docs/latest/operate/rs/release-notes/rs-7-22-releases/rs-7-22-2-179/","name":"url","tags":["release-notes"]},{"url":"https://redis.io/docs/latest/operate/rs/release-notes/rs-7-8-releases/rs-7-8-6-303/","name":"url","tags":["release-notes"]},{"url":"https://raw.githubusercontent.com/redis/redis/7.4/00-RELEASENOTES","name":"url","tags":["release-notes"]},{"url":"https://raw.githubusercontent.com/redis/redis/7.2/00-RELEASENOTES","name":"url","tags":["release-notes"]},{"url":"https://raw.githubusercontent.com/redis/redis/6.2/00-RELEASENOTES","name":"url","tags":["release-notes"]}],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.1,"attackVector":"ADJACENT_NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}},{"cvssV4_0":{"version":"4.0","baseScore":7.5,"attackVector":"ADJACENT","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2026-08-27T19:12:51.964039Z","id":"CVE-2026-81934","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-416","description":"CWE-416 Use After Free","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"cisa-cg","orgId":"9119a7d8-5eab-497f-8521-727c672e3725","dateUpdated":"2026-08-31T19:17:53.121Z"},"datePublic":"2026-08-17T00:00:00.000Z"},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-08-28T15:13:56.058373Z","id":"CVE-2026-81934","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-08-28T15:14:13.092Z"}}]}}}