Redis security advisory (AV26-859)
Canada's Cyber Centre flagged a use-after-free in Redis 8.0's TLS handling, fixed in versions 8.2.9, 8.4.6, 8.6.6, 8.8.2, and 8.10.1.
Canada's Cyber Centre issued advisory AV26-859 for a use-after-free bug in Redis's tlsProcessPendingData() pending-list iteration, affecting the Redis 8.0 series. Fixed releases include 8.2.9, 8.4.6, 8.6.6, 8.8.2, and 8.10.1. Users and administrators are encouraged to review vendor guidance and update. No CVE identifier or exploitation details were provided in the advisory text.
- Use-after-free in tlsProcessPendingData() pending-list iteration
- Affects Redis 8.0 series; fixed in 8.2.9, 8.4.6, 8.6.6, 8.8.2, and 8.10.1
- Advisory relayed by Canada's Cyber Centre
- Vendors
- Redis
- Products
- Redis 8.0
- Organizations
- Canadian Centre for Cyber Security
- Countries
- Canada
From the original article
Serial Number: AV26-859 Date: August 28, 2026 As of August 27, 2026, Redis is affected by a vulnerability in the following product: Redis 8. 0 All except 8. 10.
cyber.gc.ca
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.