redis security update

{
  "id": "3101733406da9c6ff6bd2b52946649a7148779d02a52f3bc541683257bd14130",
  "url": "https://osv.dev/vulnerability/OESA-2026-4402",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "redis security update",
    "summary": "Redis is an advanced key-value store. It is often referred to as a dattructure server since keys can contain strings, hashes ,lists, sets anorted sets. Security Fix(es): In the Linux kernel, the following vulnerability has been resolved: cifs: Fix missing credit release on failure in cifs_issue_read() Fix missing release of credits in the failure path in cifs_issue_read() lest retrying the subreq just overwrites the credits value.(CVE-2026-62356) Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the privileges of the Redis server. Fixed in Redis 8.2.9, 8.4.6, 8.6.6, 8.8.2, and 8.10.1.(CVE-2026-81934) A vulnerability, which was classified as critical, was found in Redis up to 8.8.1/8.9.x.CWE is classifying the issue as CWE-125. The product reads data past the end, or before the beginning, of the intended buffer.This is going to have an impact on confidentiality, integrity, and availability.Upgrading to version 8.10.0 eliminates this vulnerability.(CVE-2026-92925)",
    "evidence": "osv:OESA-2026-4402",
    "products": [
      {
        "name": {
          "value": "redis",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "7.2.16-2.oe2403sp3",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "high",
    "structured": {
      "id": "OESA-2026-4402",
      "aliases": [
        "OESA-2026-4402"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "7.2.16-2.oe2403sp3"
                }
              ]
            }
          ],
          "package": {
            "name": "redis",
            "purl": "pkg:rpm/openEuler/redis&distro=openEuler-24.03-LTS-SP3",
            "ecosystem": "openEuler:24.03-LTS-SP3"
          },
          "database_specific": {
            "source": "https://repo.openeuler.org/security/data/osv/OESA-2026-4402.json"
          },
          "ecosystem_specific": {
            "src": [
              "redis-7.2.16-2.oe2403sp3.src.rpm"
            ],
            "x86_64": [
              "redis-7.2.16-2.oe2403sp3.x86_64.rpm",
              "redis-debuginfo-7.2.16-2.oe2403sp3.x86_64.rpm",
              "redis-debugsource-7.2.16-2.oe2403sp3.x86_64.rpm"
            ],
            "aarch64": [
              "redis-7.2.16-2.oe2403sp3.aarch64.rpm",
              "redis-debuginfo-7.2.16-2.oe2403sp3.aarch64.rpm",
              "redis-debugsource-7.2.16-2.oe2403sp3.aarch64.rpm"
            ]
          }
        }
      ],
      "modified": "2026-10-16T12:15:20.429842547Z",
      "provider": "osv",
      "upstream": [
        "CVE-2026-62356",
        "CVE-2026-81934",
        "CVE-2026-92925"
      ],
      "references": [
        "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4402",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-62356",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-81934",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-92925"
      ],
      "provider_metadata": {
        "severity": "High"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-62356",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-81934",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-92925",
        "evidence": "/upstream"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/database_specific/severity"
  },
  "source_id": "core-osv",
  "document_id": 340914,
  "published_at": "2026-10-16T12:00:13+00:00"
}