Executive brief
Redis is an in-memory data store commonly used for caching, session management, and real-time applications. When configured with TLS encryption, a use-after-free vulnerability in the pending-data list handler allows remote attackers to crash the server or potentially execute arbitrary commands, disrupting service availability and potentially compromising data integrity.
Technical details
The vulnerability is a use-after-free in the tlsProcessPendingData() function, which iterates over a pending TLS connection list using a pre-cached node pointer. When tlsHandleEvent() processes one connection and a command (e.g., CLIENT KILL) closes a different pending TLS connection, the closed connection's list node is freed via freeClient() → connClose() → connTLSClose(). If the iterator's cached next pointer references the freed node, the following listNext() call dereferences freed memory, causing a crash (SIGSEGV). Attack requires TLS to be enabled; a remote unauthenticated attacker can trigger this by establishing multiple TLS connections and sending commands that close other connections. The fix changes iteration to re-read listFirst() on each cycle and detach nodes before processing, ensuring no stale pointers are held across handler calls. Patches are available in Redis 6.2.24 and later versions.
Affected products
- Redis Redis versions prior to 6.2.24
Timeline
- 2026-08-27: disclosed
- 2026-08-17: patched: Redis 6.2.24 released with fix