Red Hat Security Advisory

RHSA-2026:69861

redis security update

Released 2026-09-22 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream E4S (v.9.4) redis-6.2.7-1.el9_4.7, redis-devel-6.2.7-1.el9_4.7, redis-doc-6.2.7-1.el9_4.7

Fixes 2 records

TI-2026-56543 CVE-2026-81934 · GHSA-32xw-c2hw-m34g

Redis TLS pending-data list use-after-free

HIGH 68

Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configured with TLS support.

CVSS 4.0HIGH 7.5 Adjacent network Low privileges No interaction EPSS 0.00479 Published 2026-08-27 Fixed in 8.2.9, 8.4.6 +10 CWE-416

TI-2026-47139 CVE-2026-66373 · GHSA-c964-568j-vxx7

Double free in Redis

HIGH 68

Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer,…

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00872 Published 2026-07-25 Fixed in 8.8.0 CWE-415