A critical use-after-free vulnerability in Redis TLS processing allows unauthenticated remote attackers to achieve arbitrary code execution.

This is a use-after-free vulnerability (CWE-416) within the tlsProcessPendingData function that occurs when Redis is configured with TLS support. The flaw enables an unauthenticated remote attacker to trigger a stale node dereference, leading to arbitrary command execution with the privileges of the Redis server process.

The ability for an unauthenticated attacker to execute arbitrary commands on a Redis server represents a total compromise of the database instance. Given the CVSS score of 9.8, this vulnerability poses a severe risk to data confidentiality, integrity, and availability. Successful exploitation could lead to data exfiltration, service disruption, or lateral movement within the network infrastructure.

Immediate Action: Update Redis to versions 8.2.9, 8.4.6, 8.6.6, 8.8.2, or 8.10.1 immediately to incorporate the necessary security patches.

Proactive Monitoring: Monitor Redis server logs for unusual connection patterns or unexpected process terminations that may indicate exploitation attempts.

Compensating Controls: If immediate patching is not feasible, consider disabling TLS support temporarily or restricting access to the Redis TLS port (default 6380) via network firewalls to only known, trusted source IP addresses.

Public Exploit Available: Yes — a functional proof-of-concept exploit exists and is documented in the technical write-up provided by v12-security.

This vulnerability is critical due to the combination of unauthenticated remote access and the potential for full system compromise. Security teams must prioritize upgrading all affected Redis instances to the patched versions specified above. Do not rely on network-level controls as the sole mitigation, as the internal logic flaw in the TLS handling requires a code-level patch to fully resolve.