Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-81934

CVE-2026-81934HIGH

Redis TLS pending-data list use-after-free

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   A   H   P   L   N   H   H   H    7.5   .0048   39.2     —

AFFECTED
  Product                      Versions     Fixed
  Redis                        unspecified  8.2.9
  Redis Software (Enterprise)  unspecified  8.2.0-46

TIMELINE
  Aug 27  Reserved by cisa-cg
  Aug 27  Published (CNA: cisa-cg)
  Aug 28  EXPLOIT PUBLISHED — CVE-2026-81934 (Redis). Public exploit reference added.
  Aug 31  EXPLOIT PUBLISHED — CVE-2026-81934 (Redis). Public exploit reference added.
  Aug 31  RESCORED — CVE-2026-81934 (Redis). CVSS 9.2 → 7.5 (NVD).

CWE-416 · CNA: cisa-cg · CVSS v4.0 · 24 references · NVD status: Awaiting Analysis

Description

Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the privileges of the Redis server.

Lifecycle

Complete event history — 5 events, chronological
Date	Event	Detail
August 27, 2026	Reserved	Reserved by cisa-cg
August 27, 2026	Published	Published (CNA: cisa-cg)
August 28, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-81934 (Redis). Public exploit reference added.
August 31, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-81934 (Redis). Public exploit reference added.
August 31, 2026	RESCORED	RESCORED — CVE-2026-81934 (Redis). CVSS 9.2 → 7.5 (NVD).

Affected

Affected products and packages — 2 rows
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Redis	Redis	—	—	8.2.9
Redis	Redis Software (Enterprise)	—	—	8.2.0-46

Weaknesses

CWE-416

References (24)

Authoritative record: CVE-2026-81934 at cve.org

Vendors: redis

Weaknesses: CWE-416

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-81934 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.