CVE-2026-81934

Name	CVE-2026-81934
Description	Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the privileges of the Redis server.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-4794-1, DSA-6538-1
Debian Bugs	1147423

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
redis (PTS)	bookworm	5:7.0.15-1~deb12u7	vulnerable
	bookworm (security)	5:7.0.15-1~deb12u10	fixed
	trixie	5:8.0.2-3+deb13u2	vulnerable
	trixie (security)	5:8.0.2-3+deb13u3	fixed
	forky, sid	5:8.0.6-3	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
redis	source	bookworm	5:7.0.15-1~deb12u10	DLA-4794-1
redis	source	trixie	5:8.0.2-3+deb13u3	DSA-6538-1
redis	source	(unstable)	5:8.0.6-3		1147423

https://github.com/redis/redis/commit/6d088c335d5c3ec49a6c28486140b498e70b7834 (8.8.2)
The same flaw in valkey is tracked in CVE-2026-56684