Snapshot 227364
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Build production-ready, resilient agents. Six new capabilities across retrieval, memory, routing, and messaging. Register now Resource Center Events & webinarsBlogVideosGlossaryResourcesArchitecture DiagramsDemo Center Resource Center Events & webinarsBlogVideosGlossaryResourcesArchitecture DiagramsDemo Center Back to blog Blog Security Advisory: CVE-2026-81934 August 28, 20261 minute read Riaz Lakhani Summarize with AI Update 9/1/2026: Following further review, the public CVE record for CVE-2026-81934 was updated to reflect a revised CVSS score of 7.5 (High). What happened? Redis identified and remediated a use-after-free vulnerability in TLS pending-data processing. Under specific conditions, an authenticated attacker could trigger the flaw and potentially execute remote code. What is the severity? The initial public CVE record assigned this vulnerability a CVSS score of 9.8 (Critical). Redis assesses the vulnerability as High, with a CVSS v4.0 score of 7.5 (CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N). Redis's assessment reflects the authenticated access, broad permissions, coordinated TLS sessions, precise runtime conditions, and target-specific adaptation required for successful exploitation. Redis has contacted the assigning organization and requested that it review the published score. We will update this advisory if the public record changes. How can you protect your Redis instance? Upgrade to a fixed release as soon as practical. Restrict Redis network access to trusted clients, enforce strong authentication and least-privilege ACLs, and remove unnecessary access to CLIENT KILL, Lua scripting, Pub/Sub, and associated keys or channels. Redis should never be exposed directly to the internet. How can I remediate? Fixed Redis Open Source releases are 8.10.1, 8.8.2, 8.6.6, 8.4.6, 8.2.9, 7.4.11, 7.2.16, and 6.2.24. Fixed Redis Software builds are 8.2.0-46, 8.0.20-96, 7.22.2-179, and 7.8.6-303. Redis Cloud Essentials subscriptions have been patched. Remediation of Redis Cloud Pro subscriptions is underway; customers who require expedited maintenance should contact their Technical Account Manager. As of August 27, 2026, Redis is not aware of active exploitation in customer environments. Sections What happened? What is the severity? How can you protect your Redis instance? How can I remediate? View as Markdown Share Get started with Redis today Speak to a Redis expert and learn more about enterprise-grade Redis today. Try for freeTalk to sales