CVE-2026-81934

Redis contains a use-after-free flaw (CWE-416) in the tlsProcessPendingData() function, which manages the TLS pending-data list, and it affects only deployments that are configured with TLS support. A remote, unauthenticated attacker who can reach the TLS-enabled Redis service can trigger the flaw; the CVSS 4.0 vector scores it as high attack complexity with present attack requirements, suggesting timing- or condition-dependent exploitation. Successful exploitation may allow the attacker to execute arbitrary commands with the privileges of the Redis server process. Any Redis installation running with TLS enabled is in scope, though affected version ranges are not specified in the available data. No public proof-of-concept exists and the flaw is not in CISA KEV (EPSS 0.4%), but related headlines note a massive Redis cryptojacking campaign hijacking thousands of Linux servers, so Redis deployments are actively targeted in the wild even if this specific flaw's exploitation is not yet confirmed.

What to do: Identify Redis instances with TLS enabled (e.g., tls-port or cluster TLS configuration) and restrict network access to trusted clients, since only TLS-enabled deployments are affected. Upgrade to a patched Redis release when the vendor publishes one (affected version ranges are not specified in the available data). In the meantime, monitor Redis servers for indicators of the cryptojacking activity reported against Redis deployments in the wild.