{"id":"CVE-2026-81934","summary":"Redis TLS pending-data list use-after-free","details":"Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the privileges of the Redis server.","modified":"2026-09-09T12:11:39.659538382Z","published":"2026-08-27T19:40:15.141Z","related":["ALSA-2026:64823","ALSA-2026:64824"],"database_specific":{"cwe_ids":["CWE-416"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81934.json","unresolved_ranges":[{"extracted_events":[{"fixed":"8.2.0-46"},{"fixed":"8.0.20-96"},{"fixed":"7.22.2-179"},{"fixed":"7.8.6-303"}],"source":"AFFECTED_FIELD"}],"cna_assigner":"cisa-cg"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81934.json"},{"type":"ADVISORY","url":"https://github.com/redis/redis/releases/tag/6.2.24"},{"type":"ADVISORY","url":"https://github.com/redis/redis/releases/tag/7.2.16"},{"type":"ADVISORY","url":"https://github.com/redis/redis/releases/tag/7.4.11"},{"type":"ADVISORY","url":"https://github.com/redis/redis/releases/tag/8.10.1"},{"type":"ADVISORY","url":"https://github.com/redis/redis/releases/tag/8.2.9"},{"type":"ADVISORY","url":"https://github.com/redis/redis/releases/tag/8.4.6"},{"type":"ADVISORY","url":"https://github.com/redis/redis/releases/tag/8.6.6"},{"type":"ADVISORY","url":"https://github.com/redis/redis/releases/tag/8.8.2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81934"},{"type":"ADVISORY","url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-239-01.json"},{"type":"ADVISORY","url":"https://raw.githubusercontent.com/redis/redis/6.2/00-RELEASENOTES"},{"type":"ADVISORY","url":"https://raw.githubusercontent.com/redis/redis/7.2/00-RELEASENOTES"},{"type":"ADVISORY","url":"https://raw.githubusercontent.com/redis/redis/7.4/00-RELEASENOTES"},{"type":"ADVISORY","url":"https://raw.githubusercontent.com/redis/redis/8.10/00-RELEASENOTES"},{"type":"ADVISORY","url":"https://raw.githubusercontent.com/redis/redis/8.2/00-RELEASENOTES"},{"type":"ADVISORY","url":"https://raw.githubusercontent.com/redis/redis/8.4/00-RELEASENOTES"},{"type":"ADVISORY","url":"https://raw.githubusercontent.com/redis/redis/8.6/00-RELEASENOTES"},{"type":"ADVISORY","url":"https://raw.githubusercontent.com/redis/redis/8.8/00-RELEASENOTES"},{"type":"ADVISORY","url":"https://redis.io/docs/latest/operate/rs/release-notes/rs-7-22-releases/rs-7-22-2-179/"},{"type":"ADVISORY","url":"https://redis.io/docs/latest/operate/rs/release-notes/rs-7-8-releases/rs-7-8-6-303/"},{"type":"ADVISORY","url":"https://redis.io/docs/latest/operate/rs/release-notes/rs-8-0-releases/rs-8-0-20-96/"},{"type":"ADVISORY","url":"https://redis.io/docs/latest/operate/rs/release-notes/rs-8-2-releases/rs-8-2-0-46/"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-81934"},{"type":"FIX","url":"https://github.com/redis/redis/commit/6d088c335d5c3ec49a6c28486140b498e70b7834"},{"type":"EVIDENCE","url":"https://github.com/v12-security/pocs/tree/main/redis/server_ssl"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/redis/redis","events":[{"introduced":"0"},{"fixed":"c5031f43a7eaa0d96311746acf759ee6d6acb053"},{"fixed":"0eb14894da51df6d1e4a748e3308b95deb85617d"},{"fixed":"3f94c9f84d36da888d6ad0cdbab8962e1f3dbd7c"},{"fixed":"c78094fd4710bca2fa28d5dd2266b9b753b9868d"},{"fixed":"3399357e7c17b668289386b8a15a3037bc4527b1"},{"fixed":"aaf0ce63b3239f4b51f86ca1da8711b055721993"},{"fixed":"bfb69472301cb656043d3cbba332b406ef1d885a"},{"fixed":"335554f18caf7bbf6b0ac2b3548133d750f00a1b"},{"fixed":"6d088c335d5c3ec49a6c28486140b498e70b7834"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"8.8.2"},{"fixed":"8.2.9"},{"fixed":"8.4.6"},{"fixed":"8.6.6"},{"fixed":"8.10.1"},{"fixed":"7.4.11"},{"fixed":"6.2.24"},{"fixed":"7.2.16"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["7.4.10","7.2.15","8.10.0","8.8.1","8.6.5","8.4.5","8.2.8","8.10-rc2","6.2.23","8.8.0","8.6.4","8.4.4","8.2.7","6.2.22","8.10-rc1","8.10-m04-int","8.10-m03-int","8.10-m02-int","8.10-m01-int","8.8-rc1","8.8-m03","8.2.6","7.4.9","7.2.14","8.4.3","8.6.3","7.2.13","6.2.21","8.6.2","8.4.2","8.2.5","8.8-m02","7.4.8","8.6.1","8.6.0","8.4.1","8.2.4","7.4.7","7.2.12","8.6-rc1","8.2.3","8.4.0","8.4-int3","8.4-int2","8.4-rc1","8.4-int","8.4-rc1-int","8.2.2","7.2.11","6.2.20","7.4.6","8.4-m01-int","8.2.2-int","6.2.19","8.2.1","8.2.1-int","7.2.10","8.2.0","8.2-int","8.2-rc1","7.4.5","7.2.9","6.2.18","7.4.4","8.2-rc1-int","8.2-m01","8.2-m01-int2","8.2-m01-int","7.2.8","7.4.3","7.4.2","7.2.7","6.2.17","7.2.6","7.4.1","6.2.16","6.2.15","6.2.14","7.4.0","7.4-rc2","7.4-rc1","7.2.5","7.2.4","7.2.3","7.2.2","7.2.1","6.2.13","7.2.0","7.2-rc3","7.2-rc2","6.2.12","7.2-rc1","6.2.11","6.2.10","6.2.9","6.2.8","6.2.7","6.2.6","6.2.5","6.2.4","6.2.3","6.2.2","6.2.1","6.2.0","6.2-rc3","6.2-rc2","6.2-rc1","2.3-alpha0","2.2.0-rc1","2.2-alpha6","2.2-alpha5","2.2-alpha4","2.2-alpha3","2.2-alpha2","2.2-alpha1","2.2-alpha0","v2.0.0-rc1","v2.1.1-watch","v1.3.11","v1.3.10","v1.3.9","v1.3.8","v1.3.7","1.3.6","vm-playpen"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-81934.json","vanir_signatures_modified":"2026-09-02T08:13:46Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/redis/redis/commit/6d088c335d5c3ec49a6c28486140b498e70b7834","target":{"file":"src/tls.c"},"deprecated":false,"digest":{"line_hashes":["128330966063640458177165127154043914103","68565331001453725688164561068389013121","293366915637562491569134048175105274626","238356628685182825189061293718483789312","251010466998149454815479957341446555758","91211893321144979629165339915411646108","222235737238863679436292414109635472321","162414704591053017749326517923089046738","198071868249015045736900182625827027817","281756496751194748324509474716653118956","126627964511863400972304111509054999908"],"threshold":0.9},"id":"CVE-2026-81934-a82e2886","signature_type":"Line"},{"source":"https://github.com/redis/redis/commit/6d088c335d5c3ec49a6c28486140b498e70b7834","target":{"file":"src/tls.c","function":"tlsProcessPendingData"},"deprecated":false,"digest":{"length":313,"function_hash":"129583593005033021929188056092136550346"},"id":"CVE-2026-81934-f9a5c822","signature_type":"Function","signature_version":"v1"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}