Detections
Analytics

Redis 8.2.x < 8.2.9 / 8.4.x < 8.4.6 / 8.6.x < 8.6.6 / 8.8.x < 8.8.2 / 8.10.x < 8.10.1 Multiple Vulnerabilities

high Nessus Plugin ID 350289

Synopsis

A database server running on the remote host is affected by multiple vulnerabilities.

Description

The version of Redis installed on the remote host is 8.2.x prior to 8.2.9, 8.4.x prior to 8.4.6, 8.6.x prior to 8.6.6, 8.8.x prior to 8.8.2, or 8.10.x prior to 8.10.1. It is, therefore, affected by multiple vulnerabilities:

 - A use-after-free vulnerability in the tlsProcessPendingData() function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the privileges of the Redis server. (CVE-2026-81934)

 - A miscalculated buffer size in CMSketch RDB loading may lead to a heap out-of-bounds write.
 (CVE-2026-62356)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Redis version 8.2.9 / 8.4.6 / 8.6.6 / 8.8.2 / 8.10.1 or later.

See Also

https://raw.githubusercontent.com/redis/redis/8.10/00-RELEASENOTES

https://raw.githubusercontent.com/redis/redis/8.2/00-RELEASENOTES

https://raw.githubusercontent.com/redis/redis/8.4/00-RELEASENOTES

https://raw.githubusercontent.com/redis/redis/8.6/00-RELEASENOTES

https://raw.githubusercontent.com/redis/redis/8.8/00-RELEASENOTES

Plugin Details

Severity: High

ID: 350289

File Name: redis_8_10_1.nasl

Version: 1.1

Type: Combined

Agent: unix

Family: Misc.

Published: 9/25/2026

Updated: 9/25/2026

Configuration: Enable paranoid mode, Enable thorough checks (optional)

Supported Sensors: Nessus Agent, Nessus

Risk Information

CVSS Score Rationale: Score based on nvd cvssv3 vector (av:a/ac:h/pr:l).

VPR

Risk Factor: High

Score: 7.6

Percentile: 98.28

CVSS v2

Risk Factor: Medium

Base Score: 6.5

Vector: CVSS2#AV:A/AC:H/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-81934

CVSS v3

Risk Factor: High

Base Score: 7.1

Vector: CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS Score Source: CVE-2026-62356

CVSS v4

Risk Factor: High

Base Score: 7.5

Vector: CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

CPE: cpe:/a:redis:redis

Required KB Items: Settings/ParanoidReport, installed_sw/Redis Server

Patch Publication Date: 8/17/2026

Vulnerability Publication Date: 8/17/2026

Reference Information

CVE: CVE-2026-62356, CVE-2026-81934

CWE: 416

IAVA: 2026-A-1052