CVE-2026-81934
CVSS 9.8 CRITICAL: redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configured with TLS support.
Vulnerabilities & Exploits · Zero-Day Exploit
CSIRT-ITA says a public proof of concept and active internet exploitation are targeting CVE-2026-81934 in Redis, affecting TLS-enabled instances and allowing unauthenticated remote arbitrary command execution with server privileges. The advisory covers Redis 6.2.x through 8.10.x, with fixed releases already published.
The bug sits in tlsProcessPendingData(), the code that handles pending TLS data. In plain terms, the flaw is inside the encrypted connection path itself, so turning on TLS does not make Redis safer here; it gives a remote client a way to reach the command-processing code that should have stayed protected.
For operators, the exposure is the Redis server process on any TLS-enabled instance that is reachable and still on a vulnerable build. The patch closes the specific path, but it does not change the trust lesson: encryption alone does not neutralize bugs in the protocol handler behind it.
1 source · 3 days ago
CVSS 9.8 CRITICAL: redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configured with TLS support.
CSIRT Italia / ACN
Redis: PoC pubblico e sfruttamento attivo in rete della CVE-2026-81934
Rilevato PoC pubblico per la la vulnerabilità identificata tramite la CVE-2026-81934 in Redis, sistema per l'archiviazione e la gestione di dati in memoria.
originalPart of the PlainSec briefing for 2026-09-21
Every edition of this story: Redis TLS Bug Is Already Being Exploited