CyberRota Analysis
AI-GeneratedRedis servers configured with TLS support are vulnerable due to a use-after-free flaw in the 'tlsProcessPendingData()' function, allowing remote, unauthenticated attackers to execute arbitrary commands with server privileges. Organizations using Redis in environments where TLS is enabled should prioritize applying the security updates available in versions 8.2.9, 8.4.6, 8.6.6, 8.8.2, and 8.10.1 to mitigate this critical risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the privileges of the Redis server.