Security1 hOctober 3, 2026, 21:40

Redis saw three RCEs in August 2026, one bypassing an earlier fix

Redis disclosed three remote code execution flaws in August 2026. The main one is a use-after-free in tlsProcessPendingData() (QVD-2026-58458, CVSS cut from 9.8 to 7.5), fixed in 8.10.1, 8.8.2, 8.6.6, 8.4.6, 8.2.9, 7.4.11, 7.2.16 and 6.2.24. Another flaw bypassed the patch for CVE-2026-23479.

DEV Community

Open source

QVD-2026-58458 is a use-after-free in tlsProcessPendingData() with TLS builds
CVSS cut from 9.8 to 7.5 due to auth and runtime requirements
Fixes span branches 6.2.24 through 8.10.1
Bypass of CVE-2026-23479 uses XGROUP, EVAL and RESTORE

#Redis

Three Artifactory flaws under active exploitation allow auth bypass and admin access

Security

MikroTik patches three RouterOS flaws, including SSH auth bypass

Security

Tornado 6.5.9 fixes three flaws: symlinks, response size, query string

Software

Redis saw three RCEs in August 2026, one bypassing an earlier fix

Three Artifactory flaws under active exploitation allow auth bypass and admin access

MikroTik patches three RouterOS flaws, including SSH auth bypass

Tornado 6.5.9 fixes three flaws: symlinks, response size, query string

Google Home September Update Fixes Battery Drain and Three Other Issues