What happened?
Redis identified and remediated a use-after-free vulnerability in TLS pending-data processing. Under specific conditions, an authenticated attacker could trigger the flaw and potentially execute remote code.
What is the severity?
The initial public CVE record assigned this vulnerability a CVSS score of 9.8 (Critical). Redis assesses the vulnerability as High, with a CVSS v4.0 score of 7.5 (CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N).
Redis's assessment reflects the authenticated access, broad permissions, coordinated TLS sessions, precise runtime conditions, and target-specific adaptation required for successful exploitation. Redis has contacted the assigning organization and requested that it review the published score. We will update this advisory if the public record changes.
How can you protect your Redis instance?
Upgrade to a fixed release as soon as practical. Restrict Redis network access to trusted clients, enforce strong authentication and least-privilege ACLs, and remove unnecessary access to CLIENT KILL, Lua scripting, Pub/Sub, and associated keys or channels. Redis should never be exposed directly to the internet.
How can I remediate?
Fixed Redis Open Source releases are 8.10.1, 8.8.2, 8.6.6, 8.4.6, 8.2.9, 7.4.11, 7.2.16, and 6.2.24.
Fixed Redis Software builds are 8.2.0-46, 8.0.20-96, 7.22.2-179, and 7.8.6-303.
Redis Cloud Essentials subscriptions have been patched. Remediation of Redis Cloud Pro subscriptions is underway; customers who require expedited maintenance should contact their Technical Account Manager.
As of August 27, 2026, Redis is not aware of active exploitation in customer environments.
Get started with Redis today
Speak to a Redis expert and learn more about enterprise-grade Redis today.