Vulnerability-Lookup

RHSA-2026:64824

Vulnerability from csaf_redhat - Published: 2026-09-08 10:23 - Updated: 2026-09-08 12:26

Summary

Red Hat Security Advisory: redis security, bug fix, and enhancement update

Severity

Important

Notes

Topic: An update for redis is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, or by appending each command to a log. Security Fix(es): * redis: Redis: Remote Code Execution via specially crafted RESTORE payload (CVE-2026-66373) * redis: Redis: Arbitrary code execution via TLS pending-data list use-after-free (CVE-2026-81934) Bug Fix(es) and Enhancement(s): * segfault because of Unsupported system page size (jemalloc) (JIRA:RHEL-180910) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-66373

A flaw was found in Redis. An authenticated attacker, in an unusual configuration where they can execute the RESTORE command, could exploit a double free vulnerability. This occurs when a specially crafted RESTORE payload references the same NACK (pending entry) by multiple consumers, and both consumers are subsequently deleted via XGROUP DELCONSUMER. Successful exploitation of this flaw could lead to remote code execution.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-1341 - Multiple Releases of Same Resource or Handle

Affected products

Fixed 21 products

Product	Version	Remediation
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-0:6.2.24-1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-0:6.2.24-1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-0:6.2.24-1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-0:6.2.24-1.el9_8.src	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-0:6.2.24-1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:6.2.24-1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:6.2.24-1.el9_8.i686	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:6.2.24-1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:6.2.24-1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:6.2.24-1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:6.2.24-1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:6.2.24-1.el9_8.i686	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:6.2.24-1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:6.2.24-1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:6.2.24-1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:6.2.24-1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:6.2.24-1.el9_8.i686	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:6.2.24-1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:6.2.24-1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:6.2.24-1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-doc-0:6.2.24-1.el9_8.noarch	—	Vendor Fix fix

Threats

Impact Important

CVE-2026-81934

A flaw was found in Redis. This vulnerability, a use-after-free, exists within the `tlsProcessPendingData()` function, which manages the Transport Layer Security (TLS) pending-data list when Redis is configured with TLS support. A remote, unauthenticated attacker could exploit this to execute unauthorized commands with the same privileges as the Redis server.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Fixed 21 products

Product	Version	Remediation
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-0:6.2.24-1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-0:6.2.24-1.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-0:6.2.24-1.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-0:6.2.24-1.el9_8.src	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-0:6.2.24-1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:6.2.24-1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:6.2.24-1.el9_8.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:6.2.24-1.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:6.2.24-1.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:6.2.24-1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:6.2.24-1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:6.2.24-1.el9_8.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:6.2.24-1.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:6.2.24-1.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:6.2.24-1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:6.2.24-1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:6.2.24-1.el9_8.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:6.2.24-1.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:6.2.24-1.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:6.2.24-1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:redis-doc-0:6.2.24-1.el9_8.noarch	—	Vendor Fix fix Workaround

Threats

Impact Important

References

26 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:64824	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2506985	external
https://bugzilla.redhat.com/show_bug.cgi?id=2525226	external
https://issues.redhat.com/browse/RHEL-180910	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-66373	self
https://bugzilla.redhat.com/show_bug.cgi?id=2506985	external
https://www.cve.org/CVERecord?id=CVE-2026-66373	external
https://nvd.nist.gov/vuln/detail/CVE-2026-66373	external
https://github.com/berabuddies/redis-poc	external
https://github.com/redis/redis/compare/8.6.4...8.8.0	external
https://github.com/redis/redis/pull/15081	external
https://news.ycombinator.com/item?id=49024938	external
https://x.com/Fried_rice/status/2080059356322918777	external
https://access.redhat.com/security/cve/CVE-2026-81934	self
https://bugzilla.redhat.com/show_bug.cgi?id=2525226	external
https://www.cve.org/CVERecord?id=CVE-2026-81934	external
https://nvd.nist.gov/vuln/detail/CVE-2026-81934	external
https://github.com/redis/redis/commit/6d088c335d5…	external
https://github.com/v12-security/pocs/tree/main/re…	external
https://raw.githubusercontent.com/redis/redis/8.1…	external
https://raw.githubusercontent.com/redis/redis/8.2…	external
https://raw.githubusercontent.com/redis/redis/8.4…	external
https://raw.githubusercontent.com/redis/redis/8.6…	external
https://raw.githubusercontent.com/redis/redis/8.8…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for redis is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, or by appending each command to a log.\n\nSecurity Fix(es):\n\n* redis: Redis: Remote Code Execution via specially crafted RESTORE payload (CVE-2026-66373)\n\n* redis: Redis: Arbitrary code execution via TLS pending-data list use-after-free (CVE-2026-81934)\n\nBug Fix(es) and Enhancement(s):\n\n* segfault because of Unsupported system page size (jemalloc) (JIRA:RHEL-180910)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:64824",
        "url": "https://access.redhat.com/errata/RHSA-2026:64824"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2506985",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506985"
      },
      {
        "category": "external",
        "summary": "2525226",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2525226"
      },
      {
        "category": "external",
        "summary": "RHEL-180910",
        "url": "https://issues.redhat.com/browse/RHEL-180910"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_64824.json"
      }
    ],
    "title": "Red Hat Security Advisory: redis security, bug fix, and enhancement update",
    "tracking": {
      "current_release_date": "2026-09-08T12:26:28+00:00",
      "generator": {
        "date": "2026-09-08T12:26:28+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.16"
        }
      },
      "id": "RHSA-2026:64824",
      "initial_release_date": "2026-09-08T10:23:48+00:00",
      "revision_history": [
        {
          "date": "2026-09-08T10:23:48+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-08T10:23:48+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-09-08T12:26:28+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                  "product_id": "AppStream-9.8.0.Z.MAIN.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:9::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "redis-0:6.2.24-1.el9_8.src",
                "product": {
                  "name": "redis-0:6.2.24-1.el9_8.src",
                  "product_id": "redis-0:6.2.24-1.el9_8.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis@6.2.24-1.el9_8?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "redis-0:6.2.24-1.el9_8.aarch64",
                "product": {
                  "name": "redis-0:6.2.24-1.el9_8.aarch64",
                  "product_id": "redis-0:6.2.24-1.el9_8.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis@6.2.24-1.el9_8?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "redis-devel-0:6.2.24-1.el9_8.aarch64",
                "product": {
                  "name": "redis-devel-0:6.2.24-1.el9_8.aarch64",
                  "product_id": "redis-devel-0:6.2.24-1.el9_8.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis-devel@6.2.24-1.el9_8?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "redis-debugsource-0:6.2.24-1.el9_8.aarch64",
                "product": {
                  "name": "redis-debugsource-0:6.2.24-1.el9_8.aarch64",
                  "product_id": "redis-debugsource-0:6.2.24-1.el9_8.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis-debugsource@6.2.24-1.el9_8?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "redis-debuginfo-0:6.2.24-1.el9_8.aarch64",
                "product": {
                  "name": "redis-debuginfo-0:6.2.24-1.el9_8.aarch64",
                  "product_id": "redis-debuginfo-0:6.2.24-1.el9_8.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis-debuginfo@6.2.24-1.el9_8?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "redis-0:6.2.24-1.el9_8.ppc64le",
                "product": {
                  "name": "redis-0:6.2.24-1.el9_8.ppc64le",
                  "product_id": "redis-0:6.2.24-1.el9_8.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis@6.2.24-1.el9_8?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "redis-devel-0:6.2.24-1.el9_8.ppc64le",
                "product": {
                  "name": "redis-devel-0:6.2.24-1.el9_8.ppc64le",
                  "product_id": "redis-devel-0:6.2.24-1.el9_8.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis-devel@6.2.24-1.el9_8?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "redis-debugsource-0:6.2.24-1.el9_8.ppc64le",
                "product": {
                  "name": "redis-debugsource-0:6.2.24-1.el9_8.ppc64le",
                  "product_id": "redis-debugsource-0:6.2.24-1.el9_8.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis-debugsource@6.2.24-1.el9_8?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "redis-debuginfo-0:6.2.24-1.el9_8.ppc64le",
                "product": {
                  "name": "redis-debuginfo-0:6.2.24-1.el9_8.ppc64le",
                  "product_id": "redis-debuginfo-0:6.2.24-1.el9_8.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis-debuginfo@6.2.24-1.el9_8?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "redis-0:6.2.24-1.el9_8.x86_64",
                "product": {
                  "name": "redis-0:6.2.24-1.el9_8.x86_64",
                  "product_id": "redis-0:6.2.24-1.el9_8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis@6.2.24-1.el9_8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "redis-devel-0:6.2.24-1.el9_8.x86_64",
                "product": {
                  "name": "redis-devel-0:6.2.24-1.el9_8.x86_64",
                  "product_id": "redis-devel-0:6.2.24-1.el9_8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis-devel@6.2.24-1.el9_8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "redis-debugsource-0:6.2.24-1.el9_8.x86_64",
                "product": {
                  "name": "redis-debugsource-0:6.2.24-1.el9_8.x86_64",
                  "product_id": "redis-debugsource-0:6.2.24-1.el9_8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis-debugsource@6.2.24-1.el9_8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "redis-debuginfo-0:6.2.24-1.el9_8.x86_64",
                "product": {
                  "name": "redis-debuginfo-0:6.2.24-1.el9_8.x86_64",
                  "product_id": "redis-debuginfo-0:6.2.24-1.el9_8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis-debuginfo@6.2.24-1.el9_8?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "redis-devel-0:6.2.24-1.el9_8.i686",
                "product": {
                  "name": "redis-devel-0:6.2.24-1.el9_8.i686",
                  "product_id": "redis-devel-0:6.2.24-1.el9_8.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis-devel@6.2.24-1.el9_8?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "redis-debugsource-0:6.2.24-1.el9_8.i686",
                "product": {
                  "name": "redis-debugsource-0:6.2.24-1.el9_8.i686",
                  "product_id": "redis-debugsource-0:6.2.24-1.el9_8.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis-debugsource@6.2.24-1.el9_8?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "redis-debuginfo-0:6.2.24-1.el9_8.i686",
                "product": {
                  "name": "redis-debuginfo-0:6.2.24-1.el9_8.i686",
                  "product_id": "redis-debuginfo-0:6.2.24-1.el9_8.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis-debuginfo@6.2.24-1.el9_8?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "redis-0:6.2.24-1.el9_8.s390x",
                "product": {
                  "name": "redis-0:6.2.24-1.el9_8.s390x",
                  "product_id": "redis-0:6.2.24-1.el9_8.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis@6.2.24-1.el9_8?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "redis-devel-0:6.2.24-1.el9_8.s390x",
                "product": {
                  "name": "redis-devel-0:6.2.24-1.el9_8.s390x",
                  "product_id": "redis-devel-0:6.2.24-1.el9_8.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis-devel@6.2.24-1.el9_8?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "redis-debugsource-0:6.2.24-1.el9_8.s390x",
                "product": {
                  "name": "redis-debugsource-0:6.2.24-1.el9_8.s390x",
                  "product_id": "redis-debugsource-0:6.2.24-1.el9_8.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis-debugsource@6.2.24-1.el9_8?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "redis-debuginfo-0:6.2.24-1.el9_8.s390x",
                "product": {
                  "name": "redis-debuginfo-0:6.2.24-1.el9_8.s390x",
                  "product_id": "redis-debuginfo-0:6.2.24-1.el9_8.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis-debuginfo@6.2.24-1.el9_8?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "redis-doc-0:6.2.24-1.el9_8.noarch",
                "product": {
                  "name": "redis-doc-0:6.2.24-1.el9_8.noarch",
                  "product_id": "redis-doc-0:6.2.24-1.el9_8.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis-doc@6.2.24-1.el9_8?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-0:6.2.24-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:redis-0:6.2.24-1.el9_8.aarch64"
        },
        "product_reference": "redis-0:6.2.24-1.el9_8.aarch64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-0:6.2.24-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:redis-0:6.2.24-1.el9_8.ppc64le"
        },
        "product_reference": "redis-0:6.2.24-1.el9_8.ppc64le",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-0:6.2.24-1.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:redis-0:6.2.24-1.el9_8.s390x"
        },
        "product_reference": "redis-0:6.2.24-1.el9_8.s390x",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-0:6.2.24-1.el9_8.src as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:redis-0:6.2.24-1.el9_8.src"
        },
        "product_reference": "redis-0:6.2.24-1.el9_8.src",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-0:6.2.24-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:redis-0:6.2.24-1.el9_8.x86_64"
        },
        "product_reference": "redis-0:6.2.24-1.el9_8.x86_64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-debuginfo-0:6.2.24-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:6.2.24-1.el9_8.aarch64"
        },
        "product_reference": "redis-debuginfo-0:6.2.24-1.el9_8.aarch64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-debuginfo-0:6.2.24-1.el9_8.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:6.2.24-1.el9_8.i686"
        },
        "product_reference": "redis-debuginfo-0:6.2.24-1.el9_8.i686",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-debuginfo-0:6.2.24-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:6.2.24-1.el9_8.ppc64le"
        },
        "product_reference": "redis-debuginfo-0:6.2.24-1.el9_8.ppc64le",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-debuginfo-0:6.2.24-1.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:6.2.24-1.el9_8.s390x"
        },
        "product_reference": "redis-debuginfo-0:6.2.24-1.el9_8.s390x",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-debuginfo-0:6.2.24-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:6.2.24-1.el9_8.x86_64"
        },
        "product_reference": "redis-debuginfo-0:6.2.24-1.el9_8.x86_64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-debugsource-0:6.2.24-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:6.2.24-1.el9_8.aarch64"
        },
        "product_reference": "redis-debugsource-0:6.2.24-1.el9_8.aarch64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-debugsource-0:6.2.24-1.el9_8.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:6.2.24-1.el9_8.i686"
        },
        "product_reference": "redis-debugsource-0:6.2.24-1.el9_8.i686",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-debugsource-0:6.2.24-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:6.2.24-1.el9_8.ppc64le"
        },
        "product_reference": "redis-debugsource-0:6.2.24-1.el9_8.ppc64le",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-debugsource-0:6.2.24-1.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:6.2.24-1.el9_8.s390x"
        },
        "product_reference": "redis-debugsource-0:6.2.24-1.el9_8.s390x",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-debugsource-0:6.2.24-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:6.2.24-1.el9_8.x86_64"
        },
        "product_reference": "redis-debugsource-0:6.2.24-1.el9_8.x86_64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-devel-0:6.2.24-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:6.2.24-1.el9_8.aarch64"
        },
        "product_reference": "redis-devel-0:6.2.24-1.el9_8.aarch64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-devel-0:6.2.24-1.el9_8.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:6.2.24-1.el9_8.i686"
        },
        "product_reference": "redis-devel-0:6.2.24-1.el9_8.i686",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-devel-0:6.2.24-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:6.2.24-1.el9_8.ppc64le"
        },
        "product_reference": "redis-devel-0:6.2.24-1.el9_8.ppc64le",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-devel-0:6.2.24-1.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:6.2.24-1.el9_8.s390x"
        },
        "product_reference": "redis-devel-0:6.2.24-1.el9_8.s390x",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-devel-0:6.2.24-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:6.2.24-1.el9_8.x86_64"
        },
        "product_reference": "redis-devel-0:6.2.24-1.el9_8.x86_64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-doc-0:6.2.24-1.el9_8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:redis-doc-0:6.2.24-1.el9_8.noarch"
        },
        "product_reference": "redis-doc-0:6.2.24-1.el9_8.noarch",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-66373",
      "cwe": {
        "id": "CWE-1341",
        "name": "Multiple Releases of Same Resource or Handle"
      },
      "discovery_date": "2026-07-25T01:00:50.771125+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2506985"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Redis. An authenticated attacker, in an unusual configuration where they can execute the RESTORE command, could exploit a double free vulnerability. This occurs when a specially crafted RESTORE payload references the same NACK (pending entry) by multiple consumers, and both consumers are subsequently deleted via XGROUP DELCONSUMER. Successful exploitation of this flaw could lead to remote code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "redis: Redis: Remote Code Execution via specially crafted RESTORE payload",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:redis-0:6.2.24-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-0:6.2.24-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-0:6.2.24-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-0:6.2.24-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-0:6.2.24-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:6.2.24-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:6.2.24-1.el9_8.i686",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:6.2.24-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:6.2.24-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:6.2.24-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:6.2.24-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:6.2.24-1.el9_8.i686",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:6.2.24-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:6.2.24-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:6.2.24-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:6.2.24-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:6.2.24-1.el9_8.i686",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:6.2.24-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:6.2.24-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:6.2.24-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-doc-0:6.2.24-1.el9_8.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-66373"
        },
        {
          "category": "external",
          "summary": "RHBZ#2506985",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506985"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-66373",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-66373"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-66373",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66373"
        },
        {
          "category": "external",
          "summary": "https://github.com/berabuddies/redis-poc",
          "url": "https://github.com/berabuddies/redis-poc"
        },
        {
          "category": "external",
          "summary": "https://github.com/redis/redis/compare/8.6.4...8.8.0",
          "url": "https://github.com/redis/redis/compare/8.6.4...8.8.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/redis/redis/pull/15081",
          "url": "https://github.com/redis/redis/pull/15081"
        },
        {
          "category": "external",
          "summary": "https://news.ycombinator.com/item?id=49024938",
          "url": "https://news.ycombinator.com/item?id=49024938"
        },
        {
          "category": "external",
          "summary": "https://x.com/Fried_rice/status/2080059356322918777",
          "url": "https://x.com/Fried_rice/status/2080059356322918777"
        }
      ],
      "release_date": "2026-07-25T00:08:35.982000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-08T10:23:48+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:6.2.24-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:6.2.24-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:6.2.24-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:6.2.24-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:6.2.24-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:6.2.24-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:6.2.24-1.el9_8.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:6.2.24-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:6.2.24-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:6.2.24-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:6.2.24-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:6.2.24-1.el9_8.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:6.2.24-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:6.2.24-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:6.2.24-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:6.2.24-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:6.2.24-1.el9_8.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:6.2.24-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:6.2.24-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:6.2.24-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-doc-0:6.2.24-1.el9_8.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:64824"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:6.2.24-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:6.2.24-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:6.2.24-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:6.2.24-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:6.2.24-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:6.2.24-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:6.2.24-1.el9_8.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:6.2.24-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:6.2.24-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:6.2.24-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:6.2.24-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:6.2.24-1.el9_8.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:6.2.24-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:6.2.24-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:6.2.24-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:6.2.24-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:6.2.24-1.el9_8.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:6.2.24-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:6.2.24-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:6.2.24-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-doc-0:6.2.24-1.el9_8.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "redis: Redis: Remote Code Execution via specially crafted RESTORE payload"
    },
    {
      "cve": "CVE-2026-81934",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "discovery_date": "2026-08-27T20:17:41.342600+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2525226"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Redis. This vulnerability, a use-after-free, exists within the `tlsProcessPendingData()` function, which manages the Transport Layer Security (TLS) pending-data list when Redis is configured with TLS support. A remote, unauthenticated attacker could exploit this to execute unauthorized commands with the same privileges as the Redis server.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "redis: Redis: Arbitrary code execution via TLS pending-data list use-after-free",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important flaw in Redis, enabling remote, unauthenticated attackers to achieve arbitrary code execution. The vulnerability specifically impacts Redis instances configured with TLS support, which is not enabled by default in Red Hat Enterprise Linux, thereby limiting exposure in standard deployments.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:redis-0:6.2.24-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-0:6.2.24-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-0:6.2.24-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-0:6.2.24-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-0:6.2.24-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:6.2.24-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:6.2.24-1.el9_8.i686",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:6.2.24-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:6.2.24-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:6.2.24-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:6.2.24-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:6.2.24-1.el9_8.i686",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:6.2.24-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:6.2.24-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:6.2.24-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:6.2.24-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:6.2.24-1.el9_8.i686",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:6.2.24-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:6.2.24-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:6.2.24-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:redis-doc-0:6.2.24-1.el9_8.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-81934"
        },
        {
          "category": "external",
          "summary": "RHBZ#2525226",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2525226"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-81934",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-81934"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-81934",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-81934"
        },
        {
          "category": "external",
          "summary": "https://github.com/redis/redis/commit/6d088c335d5c3ec49a6c28486140b498e70b7834",
          "url": "https://github.com/redis/redis/commit/6d088c335d5c3ec49a6c28486140b498e70b7834"
        },
        {
          "category": "external",
          "summary": "https://github.com/v12-security/pocs/tree/main/redis/server_ssl",
          "url": "https://github.com/v12-security/pocs/tree/main/redis/server_ssl"
        },
        {
          "category": "external",
          "summary": "https://raw.githubusercontent.com/redis/redis/8.10/00-RELEASENOTES",
          "url": "https://raw.githubusercontent.com/redis/redis/8.10/00-RELEASENOTES"
        },
        {
          "category": "external",
          "summary": "https://raw.githubusercontent.com/redis/redis/8.2/00-RELEASENOTES",
          "url": "https://raw.githubusercontent.com/redis/redis/8.2/00-RELEASENOTES"
        },
        {
          "category": "external",
          "summary": "https://raw.githubusercontent.com/redis/redis/8.4/00-RELEASENOTES",
          "url": "https://raw.githubusercontent.com/redis/redis/8.4/00-RELEASENOTES"
        },
        {
          "category": "external",
          "summary": "https://raw.githubusercontent.com/redis/redis/8.6/00-RELEASENOTES",
          "url": "https://raw.githubusercontent.com/redis/redis/8.6/00-RELEASENOTES"
        },
        {
          "category": "external",
          "summary": "https://raw.githubusercontent.com/redis/redis/8.8/00-RELEASENOTES",
          "url": "https://raw.githubusercontent.com/redis/redis/8.8/00-RELEASENOTES"
        }
      ],
      "release_date": "2026-08-27T19:40:15.141000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-08T10:23:48+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:6.2.24-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:6.2.24-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:6.2.24-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:6.2.24-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:6.2.24-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:6.2.24-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:6.2.24-1.el9_8.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:6.2.24-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:6.2.24-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:6.2.24-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:6.2.24-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:6.2.24-1.el9_8.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:6.2.24-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:6.2.24-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:6.2.24-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:6.2.24-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:6.2.24-1.el9_8.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:6.2.24-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:6.2.24-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:6.2.24-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-doc-0:6.2.24-1.el9_8.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:64824"
        },
        {
          "category": "workaround",
          "details": "For Redis instances where TLS is enabled, consider disabling TLS if it is not strictly required. Alternatively, restrict network access to the Redis server to trusted clients only, using firewall rules or network access controls, to prevent unauthenticated remote attackers from reaching the vulnerable service. If TLS is enabled, a restart of the Redis service may be required for changes to take effect.",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:6.2.24-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:6.2.24-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:6.2.24-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:6.2.24-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:6.2.24-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:6.2.24-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:6.2.24-1.el9_8.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:6.2.24-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:6.2.24-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:6.2.24-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:6.2.24-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:6.2.24-1.el9_8.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:6.2.24-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:6.2.24-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:6.2.24-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:6.2.24-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:6.2.24-1.el9_8.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:6.2.24-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:6.2.24-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:6.2.24-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-doc-0:6.2.24-1.el9_8.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:6.2.24-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:6.2.24-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:6.2.24-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:6.2.24-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-0:6.2.24-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:6.2.24-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:6.2.24-1.el9_8.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:6.2.24-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:6.2.24-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debuginfo-0:6.2.24-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:6.2.24-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:6.2.24-1.el9_8.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:6.2.24-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:6.2.24-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-debugsource-0:6.2.24-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:6.2.24-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:6.2.24-1.el9_8.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:6.2.24-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:6.2.24-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-devel-0:6.2.24-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:redis-doc-0:6.2.24-1.el9_8.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "redis: Redis: Arbitrary code execution via TLS pending-data list use-after-free"
    }
  ]
}

CVE-2026-66373 (GCVE-0-2026-66373)

Vulnerability from cvelistv5 – Published: 2026-07-25 00:08 – Updated: 2026-08-07 00:01

Summary

Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer, because deleting both consumers via XGROUP DELCONSUMER leads to a double free. NOTE: this issue exists because of an incomplete fix for CVE-2026-25243.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-27 00:00 UTC

CWE

CWE-415 - Double Free

Assigner

mitre mitre root

References

6 references

URL	Tags
https://github.com/redis/redis/pull/15081
https://github.com/redis/redis/compare/8.6.4...8.8.0
https://x.com/Fried_rice/status/2080059356322918777
https://github.com/berabuddies/redis-poc
https://news.ycombinator.com/item?id=49024938
https://lists.debian.org/debian-lts-announce/2026…

Impacted products

1 product

Vendor	Product	Version
Redis	Redis	Affected: 0 , < 8.8.0 (semver) cpe:2.3:a:redis:redis::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-66373",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-27T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-28T03:55:42.278Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/berabuddies/redis-poc"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-08-07T00:01:51.054Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2026/08/msg00012.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Redis",
          "vendor": "Redis",
          "versions": [
            {
              "lessThan": "8.8.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "8.8.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer, because deleting both consumers via XGROUP DELCONSUMER leads to a double free. NOTE: this issue exists because of an incomplete fix for CVE-2026-25243."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-415",
              "description": "CWE-415 Double Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-25T00:08:35.982Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/redis/redis/pull/15081"
        },
        {
          "url": "https://github.com/redis/redis/compare/8.6.4...8.8.0"
        },
        {
          "url": "https://x.com/Fried_rice/status/2080059356322918777"
        },
        {
          "url": "https://github.com/berabuddies/redis-poc"
        },
        {
          "url": "https://news.ycombinator.com/item?id=49024938"
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-66373",
    "datePublished": "2026-07-25T00:08:35.982Z",
    "dateReserved": "2026-07-25T00:08:35.560Z",
    "dateUpdated": "2026-08-07T00:01:51.054Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-81934 (GCVE-0-2026-81934)

Vulnerability from cvelistv5 – Published: 2026-08-27 19:40 – Updated: 2026-08-31 19:17

Title

Redis TLS pending-data list use-after-free

Summary

Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the privileges of the Redis server.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

7.5 (High)


                        
                          CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · cisa-cg (v2.0.3)

Decision recorded 2026-08-27 19:12 UTC

CWE

CWE-416 - Use After Free

Assigner

cisa-cg CISA root

References

24 references

URL	Tags
https://github.com/redis/redis/commit/6d088c335d5…	patch
https://github.com/v12-security/pocs/tree/main/re…	exploit
https://raw.githubusercontent.com/redis/redis/8.2…	release-notes
https://raw.githubusercontent.com/redis/redis/8.4…	release-notes
https://raw.githubusercontent.com/redis/redis/8.6…	release-notes
https://raw.githubusercontent.com/redis/redis/8.8…	release-notes
https://raw.githubusercontent.com/redis/redis/8.1…	release-notes
https://raw.githubusercontent.com/cisagov/CSAF/de…	third-party-advisory
https://www.cve.org/CVERecord?id=CVE-2026-81934	vdb-entry
https://github.com/redis/redis/releases/tag/6.2.24	release-notes
https://github.com/redis/redis/releases/tag/7.2.16	release-notes
https://github.com/redis/redis/releases/tag/7.4.11	release-notes
https://github.com/redis/redis/releases/tag/8.4.6	release-notes
https://github.com/redis/redis/releases/tag/8.2.9	release-notes
https://github.com/redis/redis/releases/tag/8.6.6	release-notes
https://github.com/redis/redis/releases/tag/8.8.2	release-notes
https://github.com/redis/redis/releases/tag/8.10.1	release-notes
https://redis.io/docs/latest/operate/rs/release-n…	release-notes
https://redis.io/docs/latest/operate/rs/release-n…	release-notes
https://redis.io/docs/latest/operate/rs/release-n…	release-notes
https://redis.io/docs/latest/operate/rs/release-n…	release-notes
https://raw.githubusercontent.com/redis/redis/7.4…	release-notes
https://raw.githubusercontent.com/redis/redis/7.2…	release-notes
https://raw.githubusercontent.com/redis/redis/6.2…	release-notes

Impacted products

2 products

Vendor	Product	Version
Redis	Redis	Unaffected: 8.2.9 Unaffected: 8.4.6 Unaffected: 8.6.6 Unaffected: 8.8.2 Unaffected: 8.10.1 Unaffected: 7.4.11 Unaffected: 6.2.24 Unaffected: 7.2.16 Affected: 0 , < 8.8.2 (custom) Affected: 0 , < 8.2.9 (custom) Affected: 0 , < 8.4.6 (custom) Affected: 0 , < 8.6.6 (custom) Affected: 0 , < 8.10.1 (custom) Affected: 0 , < 7.4.11 (custom) Affected: 0 , < 6.2.24 (custom) Affected: 0 , < 7.2.16 (custom)
Redis	Redis Software (Enterprise)	Unaffected: 8.2.0-46 Unaffected: 8.0.20-96 Unaffected: 7.22.2-179 Unaffected: 7.8.6-303 Affected: 0 , < 8.2.0-46 (custom) Affected: 0 , < 8.0.20-96 (custom) Affected: 0 , < 7.22.2-179 (custom) Affected: 0 , < 7.8.6-303 (custom)

Date Public

2026-08-17 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-81934",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-28T15:13:56.058373Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-28T15:14:13.092Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Redis",
          "vendor": "Redis",
          "versions": [
            {
              "status": "unaffected",
              "version": "8.2.9"
            },
            {
              "status": "unaffected",
              "version": "8.4.6"
            },
            {
              "status": "unaffected",
              "version": "8.6.6"
            },
            {
              "status": "unaffected",
              "version": "8.8.2"
            },
            {
              "status": "unaffected",
              "version": "8.10.1"
            },
            {
              "status": "unaffected",
              "version": "7.4.11"
            },
            {
              "status": "unaffected",
              "version": "6.2.24"
            },
            {
              "status": "unaffected",
              "version": "7.2.16"
            },
            {
              "lessThan": "8.8.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "8.2.9",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "8.4.6",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "8.6.6",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "8.10.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.4.11",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.2.24",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.2.16",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "Redis Software (Enterprise)",
          "vendor": "Redis",
          "versions": [
            {
              "status": "unaffected",
              "version": "8.2.0-46"
            },
            {
              "status": "unaffected",
              "version": "8.0.20-96"
            },
            {
              "status": "unaffected",
              "version": "7.22.2-179"
            },
            {
              "status": "unaffected",
              "version": "7.8.6-303"
            },
            {
              "lessThan": "8.2.0-46",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "8.0.20-96",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.22.2-179",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.8.6-303",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2026-08-17T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Redis contains a use-after-free vulnerability in the \u0027tlsProcessPendingData()\u0027 function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the privileges of the Redis server."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "ADJACENT",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        },
        {
          "other": {
            "content": {
              "id": "CVE-2026-81934",
              "options": [
                {
                  "Exploitation": "poc"
                },
                {
                  "Automatable": "no"
                },
                {
                  "Technical Impact": "total"
                }
              ],
              "role": "CISA Coordinator",
              "timestamp": "2026-08-27T19:12:51.964039Z",
              "version": "2.0.3"
            },
            "type": "ssvc"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "CWE-416 Use After Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-31T19:17:53.121Z",
        "orgId": "9119a7d8-5eab-497f-8521-727c672e3725",
        "shortName": "cisa-cg"
      },
      "references": [
        {
          "name": "url",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/redis/redis/commit/6d088c335d5c3ec49a6c28486140b498e70b7834"
        },
        {
          "name": "url",
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/v12-security/pocs/tree/main/redis/server_ssl"
        },
        {
          "name": "url",
          "tags": [
            "release-notes"
          ],
          "url": "https://raw.githubusercontent.com/redis/redis/8.2/00-RELEASENOTES"
        },
        {
          "name": "url",
          "tags": [
            "release-notes"
          ],
          "url": "https://raw.githubusercontent.com/redis/redis/8.4/00-RELEASENOTES"
        },
        {
          "name": "url",
          "tags": [
            "release-notes"
          ],
          "url": "https://raw.githubusercontent.com/redis/redis/8.6/00-RELEASENOTES"
        },
        {
          "name": "url",
          "tags": [
            "release-notes"
          ],
          "url": "https://raw.githubusercontent.com/redis/redis/8.8/00-RELEASENOTES"
        },
        {
          "name": "url",
          "tags": [
            "release-notes"
          ],
          "url": "https://raw.githubusercontent.com/redis/redis/8.10/00-RELEASENOTES"
        },
        {
          "name": "url",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-239-01.json"
        },
        {
          "name": "url",
          "tags": [
            "vdb-entry"
          ],
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-81934"
        },
        {
          "name": "url",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/redis/redis/releases/tag/6.2.24"
        },
        {
          "name": "url",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/redis/redis/releases/tag/7.2.16"
        },
        {
          "name": "url",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/redis/redis/releases/tag/7.4.11"
        },
        {
          "name": "url",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/redis/redis/releases/tag/8.4.6"
        },
        {
          "name": "url",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/redis/redis/releases/tag/8.2.9"
        },
        {
          "name": "url",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/redis/redis/releases/tag/8.6.6"
        },
        {
          "name": "url",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/redis/redis/releases/tag/8.8.2"
        },
        {
          "name": "url",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/redis/redis/releases/tag/8.10.1"
        },
        {
          "name": "url",
          "tags": [
            "release-notes"
          ],
          "url": "https://redis.io/docs/latest/operate/rs/release-notes/rs-8-2-releases/rs-8-2-0-46/"
        },
        {
          "name": "url",
          "tags": [
            "release-notes"
          ],
          "url": "https://redis.io/docs/latest/operate/rs/release-notes/rs-8-0-releases/rs-8-0-20-96/"
        },
        {
          "name": "url",
          "tags": [
            "release-notes"
          ],
          "url": "https://redis.io/docs/latest/operate/rs/release-notes/rs-7-22-releases/rs-7-22-2-179/"
        },
        {
          "name": "url",
          "tags": [
            "release-notes"
          ],
          "url": "https://redis.io/docs/latest/operate/rs/release-notes/rs-7-8-releases/rs-7-8-6-303/"
        },
        {
          "name": "url",
          "tags": [
            "release-notes"
          ],
          "url": "https://raw.githubusercontent.com/redis/redis/7.4/00-RELEASENOTES"
        },
        {
          "name": "url",
          "tags": [
            "release-notes"
          ],
          "url": "https://raw.githubusercontent.com/redis/redis/7.2/00-RELEASENOTES"
        },
        {
          "name": "url",
          "tags": [
            "release-notes"
          ],
          "url": "https://raw.githubusercontent.com/redis/redis/6.2/00-RELEASENOTES"
        }
      ],
      "title": "Redis TLS pending-data list use-after-free"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725",
    "assignerShortName": "cisa-cg",
    "cveId": "CVE-2026-81934",
    "datePublished": "2026-08-27T19:40:15.141Z",
    "dateReserved": "2026-08-27T19:15:11.715Z",
    "dateUpdated": "2026-08-31T19:17:53.121Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

RHSA-2026:64824

CVE-2026-66373 (GCVE-0-2026-66373)

CVE-2026-81934 (GCVE-0-2026-81934)

Tags

Sightings

Nomenclature