EUVD-2026-67227
GHSA-32xw-c2hw-m34g
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote unauthenticated (AV:N/PR:N/UI:N); AC:H reflects the race-condition use-after-free (mapped from CVSS 4.0 AT:P); UAF-to-RCE within the process gives C/I/A:H with no scope change.
Primary rating from Vendor (cisa-cg).
CVSS VectorVendor: cisa-cg
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the privileges of the Redis server. Fixed in Redis 8.2.9, 8.4.6, 8.6.6, 8.8.2, and 8.10.1.
Articles & Coverage 1
AnalysisAI
Remote code execution in Redis affects deployments built with TLS support, where a use-after-free in the tlsProcessPendingData() function lets a remote, unauthenticated attacker corrupt memory and run arbitrary commands with the privileges of the Redis server process. Publicly available exploit code exists (v12-security PoC), and the CVSS 4.0 base score is 9.2, though the vector's Attack Requirements flag (AT:P) indicates exploitation is not fully deterministic. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Redis must be built with TLS support and actively configured to accept TLS connections (a tls-port listener) - this is the concrete, required condition, since the vulnerable tlsProcessPendingData() code path does not exist or run in non-TLS deployments. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue rather than a high-CVSS-but-low-impact one: the CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) describes remote, unauthenticated, low-complexity access with high confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H), and a public PoC exists. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can reach the Redis TLS port opens TLS connections and drives traffic that populates and rapidly tears down entries in the TLS pending-data list, racing to trigger the use-after-free in tlsProcessPendingData(). By shaping heap state during that window, the attacker corrupts memory to hijack control flow and execute commands as the Redis server user. … |
| Remediation | Upgrade to the patched build for your branch - Vendor-released patch: Redis 8.2.9, 8.4.6, 8.6.6, 8.8.2, or 8.10.1 - per the fix commit https://github.com/redis/redis/commit/6d088c335d5c3ec49a6c28486140b498e70b7834 and the branch release notes at https://raw.githubusercontent.com/redis/redis/8.2/00-RELEASENOTES (and the 8.4/8.6/8.8/8.10 equivalents). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all Redis deployments to identify which versions use TLS support and compare against affected ranges (versions below 8.2.9, 8.4.6, 8.6.6, 8.8.2, and 8.10.1 for their respective release lines). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Privilege escalation to root in the LiteSpeed User-End cPanel Plugin (versions 2.3 through before 2.4.5) lets attackers
UAF in Redis 8.2.1 via crafted Lua scripts by authenticated users. EPSS 12.4%. Patch available.
It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific
Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10,
Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user
Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua bytecode via the eval command.
A buffer overflow in Redis 3.2.x prior to 3.2.4 causes arbitrary code execution when a crafted command is sent. Rated cr
Code injection in OneUptime monitoring via custom JS monitor using vm module. PoC and patch available.
In applications using jfinal 4.9.08 and below, there is a deserialization vulnerability when using redis,may be vulnerab
An issue was found in Apache Airflow versions 1.10.10 and below. Rated critical severity (CVSS 9.8), this vulnerability
An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4
goanother Another Redis Desktop Manager =<1.6.1 is vulnerable to Cross Site Scripting (XSS) via src/components/Setting.v
Same weakness CWE-416 – Use After Free
View allSame technique Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today