Description

Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the privileges of the Redis server. Fixed in Redis 8.2.9, 8.4.6, 8.6.6, 8.8.2, and 8.10.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-27T20:18:57.350Z",
  "pubdate": "2026-08-27T20:18:57.350Z",
  "executiveSummary": "A critical use-after-free vulnerability exists in the Redis TLS processing subsystem, specifically within the tlsProcessPendingData() function.\nThe vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands with the privileges of the Redis server process, leading to potential full system compromise.\nThis flaw affects Redis installations configured with TLS support.\nThe root cause stems from improper memory management within the pending-data list handler, which can be manipulated to trigger a use-after-free condition.\nSuccessful exploitation allows for remote code execution (RCE) without prior authentication, posing a severe risk to the confidentiality, integrity, and availability of data hosted on the Redis instance.\nThe vulnerability is resolved in Redis versions 8.2.9, 8.4.6, 8.6.6, 8.8.2, and 8.10.1.",
  "technicalDetails": "The vulnerability resides in the tlsProcessPendingData() function, which is responsible for managing TLS session data buffers in environments where TLS is explicitly enabled. The flaw is categorized as a use-after-free (UAF), occurring when the application fails to properly manage the lifecycle of memory objects associated with TLS pending-data packets.\nIn the affected versions, the tlsProcessPendingData() function incorrectly handles memory deallocation for objects contained within the internal TLS pending-data list. Specifically, a pointer to a heap-allocated buffer may remain in a valid state within the application's memory management tracking system even after the underlying memory has been freed. If the application logic subsequently attempts to access this dangling pointer, the process behavior becomes undefined.\nThe exploitation flow begins with a remote attacker initiating a TLS connection to the vulnerable Redis server. By sending specially crafted network packets that trigger the specific error-handling or data-processing paths within tlsProcessPendingData(), the attacker can force the application to prematurely free an active memory buffer while the function continues to reference it. By carefully timing the memory allocation and deallocation cycle, an attacker may be able to perform heap grooming to replace the freed memory block with malicious data.\nWhen the application erroneously accesses the dangling pointer, it processes the attacker-controlled data instead of the expected TLS packet data. This allows the attacker to hijack the execution flow of the Redis process. Because Redis executes commands in the context of the user running the server, the attacker can execute arbitrary Redis commands, read sensitive data, modify keys, or potentially achieve remote code execution depending on the state of the heap at the time of exploitation.\nThis vulnerability is particularly critical as it does not require authentication; the exploit can be initiated during the initial TLS handshake or through the transmission of pending TLS data sequences. Given the nature of Redis, which often runs with elevated system privileges to manage memory and network sockets, the impact of successful exploitation provides the attacker with full administrative control over the Redis instance. The issue is strictly tied to the TLS-enabled code paths; non-TLS deployments are not subject to this specific UAF condition."
}