Red Hat Redis Updates Address Four RHEL Vulnerabilities
Tech GuruQuick Answer
Red Hat has issued five Redis updates for the extended-support RHEL streams below. Select the advisory for the installed RHEL minor release and Redis module stream; the abbreviated upstream Redis version alone does not identify a fixed package.
Confirm Scope And Apply The Supported Fix
What to do now: Record the RHEL minor release, support repository and Redis module stream, then install the matching complete package build below. Plan the restart or cluster rollout with the service owner.
Source check: 2026-10-02 UTC. This notice reflects the primary-source evidence described below, not a completed update or exploitation test. Recheck the advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | RHEL 8.4, 8.6, 8.8, 9.4, and 9.6 extended-support Redis packages |
|---|---|
| Advisory | RHSA-2026:69542 / RHSA-2026:69533 / RHSA-2026:69534 / RHSA-2026:69521 / RHSA-2026:69520 |
| CVEs | CVE-2026-66373, CVE-2026-72568, CVE-2026-81934, CVE-2026-92925 |
| Authoritative release date | RHSA-2026:69542: 2026-09-21T17:06:25+00:00 (CSAF initial release) RHSA-2026:69534: 2026-09-21T17:08:00+00:00 (CSAF initial release) RHSA-2026:69533: 2026-09-21T17:06:45+00:00 (CSAF initial release) RHSA-2026:69521: 2026-09-21T17:10:30+00:00 (CSAF initial release) RHSA-2026:69520: 2026-09-21T17:13:50+00:00 (CSAF initial release) |
| Authority revision date | RHSA-2026:69542: 2026-09-21T17:06:25+00:00 (CSAF revision history) RHSA-2026:69534: 2026-09-21T17:08:00+00:00 (CSAF revision history) RHSA-2026:69533: 2026-09-21T17:06:45+00:00 (CSAF revision history) RHSA-2026:69521: 2026-09-21T17:10:30+00:00 (CSAF revision history) RHSA-2026:69520: 2026-09-21T17:13:50+00:00 (CSAF revision history). CSAF generation timestamps are not advisory revision dates. |
| Affected versions | Redis packages in the five listed RHEL support streams before their matching fixed RPM builds. Check the enabled module and repository; package targets are not interchangeable between minor releases. |
| Fixed version | Redis package builds (epoch 0; select the matching architecture and entitled repository): RHEL 8.4, redis:6: 6.0.9-5.module+el8.4.0+24914+3cb9e211.7RHEL 8.6, redis:6: 6.0.9-5.module+el8.6.0+24913+caade4b4.8RHEL 8.8, redis:6: 6.2.7-1.module+el8.8.0+24912+36dda224.8RHEL 9.4, redis:7: 7.0.12-2.module+el9.4.0+24911+6845972a.9RHEL 9.6, redis:7: 7.2.16-1.module+el9.6.0+24910+8b24772d |
| CVSS base score | 7.1 / 7.5 (CVSS v3.1) |
| CVSS severity | High |
| Exploitation status | The checked Red Hat CSAF advisories does not state that these flaws are being exploited. That is not confirmation that exploitation has not occurred. |
What Changed
All five updates address crafted RESTORE input and a TLS pending-data use-after-free (CVE-2026-66373 and CVE-2026-81934). The RHEL 9.4 and 9.6 updates also address cluster-bus denial of service and an out-of-bounds read (CVE-2026-72568 and CVE-2026-92925). These are a combined CVE list, not four identical fixes on every branch. Red Hat rates the advisories Important; that vendor rating is separate from the CVSS scores.
What To Validate Now
- Inventory. Locate Redis nodes, their owners, clients, TLS listeners and cluster-bus exposure; record the enabled module stream and installed RPM release.
- Establish applicability. Match each node to its own RHSA. The RHEL 8 updates cover two CVEs; the RHEL 9 updates cover all four listed here.
- Remediate. Use the full fixed build for that module and minor release, or a superseding supported erratum. Do not switch Redis major versions or RHEL repositories merely to match another row.
- Validate. Check installed RPM release strings and the version running on each Redis node. Exercise representative reads/writes, TLS client connections, replication and failover in the approved change window; record any node left on the old build.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Restrict Redis client and cluster-bus access to trusted systems while arranging the update. Although the TLS CVE includes a conditional disable-TLS workaround, removing encryption can create a separate exposure; do not turn off required TLS as a blanket fix. The RESTORE and TLS CVSS vectors require low privileges, so do not describe every flaw here as unauthenticated. Test cluster recovery and rollback before broad deployment.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
