Photon OS 5.0: Redis PHSA-2023-5.0-91-0001

An update of the redis package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2023-5.0-91-0001. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Redis PHSA-2025-5.0-91-0522

An update of the redis package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-91-0522. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

CLSA-2026-1782089830 TuxCare security update for org.springframework.data:spring-data-redis (2 CVEs)

TuxCare rebuilt org.springframework.data:spring-data-redis to address 2 CVEs. Fixed in 2.7.18-tuxcare.3...

CLSA-2026-1776818209 TuxCare security update for redis (1 CVE)

TuxCare rebuilt redis to address 1 CVE. Fixed in 2.8.0-tuxcare.1...

CLSA-2025-1758759148 TuxCare security update for redis (2 CVEs)

TuxCare rebuilt redis to address 2 CVEs. Fixed in 4.5.1.post1+tuxcare...

netty-codec-redis: Netty: Denial of Service via malicious Redis array header

A flaw was found in Netty, a network application framework. The RedisArrayAggregator component pre-allocates memory based on the declared element count in a Redis array header. A remote attacker can exploit this by sending a small, malicious Redis array header that claims a huge initial capacity,...

netty-codec-redis: netty-codec-redis: Denial of Service via crafted Redis payload with deeply nested arrays

A flaw was found in netty-codec-redis. A remote attacker can exploit this vulnerability by sending a specially crafted Redis payload containing deeply nested arrays. This action forces the server to allocate a large number of state objects and collections, leading to memory exhaustion...

netty-codec-redis: netty-codec-redis: Denial of Service via crafted Redis payloads

A flaw was found in netty-codec-redis. A remote attacker can exploit this vulnerability by sending specially crafted Redis payloads across multiple connections without proper termination. This can exhaust the server's direct memory pool, leading to a Denial of Service DoS condition where legitima...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.7.1 XP 6.0.5.1 release

JBoss EAP XP 6.0.5.1 release on the EAP 8.1 base. See references for release notes. A security update is now available for Red Hat JBoss Enterprise Application Platform 8.1.7.1, XP 6.0.5.1. Red Hat Product Security has rated this update as having a security impact of Important. A Common...

netty-codec-redis: Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator

A flaw was found in netty-codec-redis. A remote attacker can exploit this vulnerability by repeatedly closing Redis pipeline connections before a Redis array aggregate completes. This leads to a permanent leak of direct-memory buffers, which prevents memory chunks from being returned to the share...

MAL-2026-12020 Malicious code in @keyv/redis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c6bb14bdfcd4aae57a41c9e6e04cd5f612b12e0f45fbcb57510ccb44b095e77 Analysis of @keyv/[email protected] produced no a static rule matches and no traced behavioral findings. The package is a Redis storage adapter for the key...

Malicious code in @keyv/redis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c6bb14bdfcd4aae57a41c9e6e04cd5f612b12e0f45fbcb57510ccb44b095e77 Analysis of @keyv/[email protected] produced no a static rule matches and no traced behavioral findings. The package is a Redis storage adapter for the key...

Exploit for Uncontrolled Resource Consumption in Oracle Graalvm

--- CVE-2026-22003 – Redis Lua Sandbox Escape via debug.set...

Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout

SummaryWith Redis configured, Open WebUI supports JWT revocation: POST /api/v1/auths/signout per-token jti and OIDC back-channel logout per-user revokedat record revocations in Redis, and HTTP auth getcurrentuser rejects revoked tokens with 401. The realtime authentication surfaces do not perform...

PYSEC-2026-3595 Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout

Summary With Redis configured, Open WebUI supports JWT revocation: POST /api/v1/auths/signout per-token jti and OIDC back-channel logout per-user revokedat record revocations in Redis, and HTTP auth getcurrentuser rejects revoked tokens with 401. The realtime authentication surfaces do not perfor...

Exploit for Use After Free in Redis

🔥 CVE-2026-23479 – Redis UAF Proof of Concept !Licensehtt...

PT-2026-73550

TuxCare rebuilt redis to address 2 CVEs. Fixed in 4.5.1.post1+tuxcare...

PT-2026-74529

TuxCare rebuilt redis to address 1 CVE. Fixed in 2.8.0-tuxcare.1...

PT-2026-75140

TuxCare rebuilt org.springframework.data:spring-data-redis to address 2 CVEs. Fixed in 2.7.18-tuxcare.3...

ROS-20260803-73-0005

The vulnerability of Redis’ Lua interpreter for database management systems involves the possibility of using memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...