Security Advisory: CVE-2026-81934

AI summary

Redis identified a use-after-free vulnerability in TLS pending-data processing that could allow authenticated remote code execution. While initially assigned a critical CVSS score, Redis recalibrated the severity to high based on the complex preconditions required for successful exploitation.

Key points

• A use-after-free vulnerability exists in TLS pending-data processing within Redis.
• Exploitation requires authenticated access, specific runtime conditions, and coordinated TLS sessions.
• The vulnerability's severity was reassessed to a CVSS 7.5 (High) due to the high barrier for exploitation.
• Mitigation involves upgrading to the specified patched versions and enforcing network-level restrictions.