Critical Security Update for Redis: CVE-2026-66373 and CVE-2026-81934
Summary
RHSA-2026:69542: Red Hat Security Advisory: redis:6 security update. Affects redis versions < 0:6.0.9-5.module+el8.4.0+24914+3cb9e211.7. Fixed in 0:6.0.9-5.module+el8.4.0+24914+3cb9e211.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Redis is an open-source, in-memory data structure store, used as a database, cache, and message broker. It is known for its high performance, flexibility, and support for various data structures such as strings, hashes, lists, sets, and more. However, vulnerabilities can arise, affecting its security and integrity, making timely updates essential for users.
Vulnerability Detail
The vulnerabilities identified as CVE-2026-66373 and CVE-2026-81934 in Redis could allow an attacker to exploit weaknesses in the software, potentially leading to unauthorized access, data corruption, or service disruption. These vulnerabilities stem from improper handling of certain commands and can have severe implications for data confidentiality, integrity, and availability.
How To Fix
Minimum fixed version
0:6.0.9-5.module+el8.4.0+24914+3cb9e211.7
This is the first release that contains the fix.
sudo dnf update redisTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to the Redis server by configuring firewall rules to limit connections to trusted IP addresses only. This can help mitigate the risk of exploitation until the update is applied.
Conclusion
The Redis vulnerabilities CVE-2026-66373 and CVE-2026-81934 pose significant risks to users, necessitating immediate action to update to the patched version. By following the outlined steps and utilizing available resources like Vulert, users can enhance their security posture and mitigate potential threats.
See every vulnerability recorded for redis →
FAQ
These are identifiers for specific vulnerabilities found in Redis that could allow unauthorized access or data manipulation.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by these vulnerabilities without needing to sign up.
The CVSS score for these vulnerabilities is 7.5, indicating a high severity level.
If immediate updates are not possible, implement firewall rules to restrict access to the Redis server as a temporary workaround.
You can visit the official Redis documentation or the Red Hat security advisory page for detailed information on security updates.
Related vulnerabilities
Recent vulnerabilities recorded for redis.
