# Security Advisory: CVE-2026-81934

**Tagline:** News & Media | **Authors:** Riaz Lakhani | **Categories:** Tech | **Published:** 2026-08-28 | **Updated:** 2026-08-28

## What happened?

Redis identified and remediated a use-after-free vulnerability in TLS pending-data processing. Under specific conditions, an authenticated attacker could trigger the flaw and potentially execute remote code.

## What is the severity?

The initial public CVE record assigned this vulnerability a CVSS score of 9.8 (Critical). Redis assesses the vulnerability as High, with a CVSS v4.0 score of 7.5 (CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N).
Redis's assessment reflects the authenticated access, broad permissions, coordinated TLS sessions, precise runtime conditions, and target-specific adaptation required for successful exploitation. Redis has contacted the assigning organization and requested that it review the published score. We will update this advisory if the public record changes.

## How can you protect your Redis instance?

Upgrade to a fixed release as soon as practical. Restrict Redis network access to trusted clients, enforce strong authentication and least-privilege ACLs, and remove unnecessary access to CLIENT KILL, Lua scripting, Pub/Sub, and associated keys or channels. Redis should never be exposed directly to the internet.

## How can I remediate?

Fixed Redis Open Source releases are 8.10.1, 8.8.2, 8.6.6, 8.4.6, 8.2.9, 7.4.11, 7.2.16, and 6.2.24.

Fixed Redis Software builds are 8.2.0-46, 8.0.20-96, 7.22.2-179, and 7.8.6-303.

Redis Cloud Essentials subscriptions have been patched. Remediation of Redis Cloud Pro subscriptions is underway; customers who require expedited maintenance should contact their Technical Account Manager.

As of August 27, 2026, Redis is not aware of active exploitation in customer environments.