Security Advisory: CVE-2026-81934

Redis identified a use-after-free vulnerability in its TLS pending-data processing mechanism. This flaw could allow an authenticated attacker to execute remote code under specific runtime conditions. The vulnerability is particularly concerning because it targets the TLS layer, which is often exposed in network-facing deployments. While the conditions for exploitation are narrow, the potential impact is severe given Redis's role in caching and data storage systems.

The vulnerability requires an attacker to have authenticated access to the Redis instance, which limits the attack surface. However, once authenticated, the attacker could leverage the flaw to gain broader control over the system. Redis's assessment of the vulnerability as High (CVSS 7.5) reflects the need for precise timing and coordination of TLS sessions, but the potential for remote code execution makes this a critical issue for operators to address promptly.

Redis has released patches for both open-source and enterprise versions of its software. Operators should upgrade to the fixed releases immediately, as the vulnerability is not known to be actively exploited at this time. In addition to upgrading, Redis recommends restricting network access to trusted clients, enforcing strong authentication, and limiting permissions to reduce the risk of exploitation. These measures are particularly important for instances exposed to untrusted networks.

The discrepancy between the initial public CVE score (9.8) and Redis's assessment (7.5) highlights the complexity of evaluating this vulnerability. While the public score suggests a critical risk, Redis's analysis accounts for the specific conditions required for exploitation, such as authenticated access and precise runtime coordination. Operators should prioritize patching but also consider the mitigating factors when assessing their risk exposure.

For Redis Cloud users, patches have been applied to Essentials subscriptions, while Pro subscriptions are being updated. Customers requiring expedited remediation should contact their Technical Account Manager. Given the potential for remote code execution, operators should treat this vulnerability as a high-priority issue and apply the recommended fixes and access controls without delay.