High 7.1Published Aug 27, 2026

CVE-2026-81934Redis TLS pending-data list use-after-free

Updated under an hour ago (Oct 28, 2026, 4:00 AM ET)

Does this affect you?

It affects Redis and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Redis

Exploited in the last 30 days

Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the privileges of the Redis server.

CVSS: 7.1 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-416
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: cisa-cg
NVD analysis: Awaiting Analysis
Record last updated: Aug 31, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Redis Redis redis:redis (from the name)	8.2.9 not affected; 8.4.6 not affected; 8.6.6 not affected; 8.8.2 not affected; 8.10.1 not affected; 7.4.11 not affected; 6.2.24 not affected; 7.2.16 not affected; and 8 more ranges	CNA record
Redis Redis Software (Enterprise) redis:software_enterprise (from the name)	8.2.0-46 not affected; 8.0.20-96 not affected; 7.22.2-179 not affected; 7.8.6-303 not affected; before 8.2.0-46; before 8.0.20-96; before 7.22.2-179; before 7.8.6-303	CNA record

References

References

https://github.com/redis/redis/commit/6d088c335d5c3ec49a6c28486140b498e70b7834	patch
https://github.com/v12-security/pocs/tree/main/redis/server_ssl	exploit
https://raw.githubusercontent.com/redis/redis/8.2/00-RELEASENOTES	release-notes
https://raw.githubusercontent.com/redis/redis/8.4/00-RELEASENOTES	release-notes
https://raw.githubusercontent.com/redis/redis/8.6/00-RELEASENOTES	release-notes
https://raw.githubusercontent.com/redis/redis/8.8/00-RELEASENOTES	release-notes
https://raw.githubusercontent.com/redis/redis/8.10/00-RELEASENOTES	release-notes
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-239-01.json	third-party-advisory
https://www.cve.org/CVERecord?id=CVE-2026-81934	vdb-entry
https://github.com/redis/redis/releases/tag/6.2.24	release-notes
1–10 of 24

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.