Red Hat Redis Updates Fix Two RHEL 9 Flaws
Tech GuruQuick Answer
RHSA-2026:69862 and :69861 fix two code-execution flaws in Redis 6.2 packages for RHEL 9.2 and 9.4 Update Services for SAP Solutions. These RPMs are not interchangeable with the separate Redis 7 module builds for RHEL 9.4.
Confirm Scope And Apply The Supported Fix
What to do now: Match each Redis node to the correct SAP-support repository and full RPM release, then schedule the package update and service rollout with replication and persistence in mind.
Source check: 2026-10-02 UTC. This notice reflects the primary-source evidence described below, not a completed update or exploitation test. Recheck the advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | RHEL 9.2 and 9.4 extended-support Redis packages |
|---|---|
| Advisory | RHSA-2026:69862 / RHSA-2026:69861 |
| CVEs | CVE-2026-66373, CVE-2026-81934 |
| Authoritative release date | RHSA-2026:69862: 2026-09-22T06:07:27+00:00 (CSAF initial release) RHSA-2026:69861: 2026-09-22T07:08:32+00:00 (CSAF initial release) |
| Authority revision date | RHSA-2026:69862: 2026-09-22T06:07:27+00:00 (CSAF revision history) RHSA-2026:69861: 2026-09-22T07:08:32+00:00 (CSAF revision history). CSAF generation timestamps are not advisory revision dates. |
| Affected versions | The exact entitled RHEL 9.2 and 9.4 extended-support Redis packages builds before the branch-specific package, image, or digest listed by Red Hat. |
| Fixed version | Redis 6.2.7-1.el9_2.7 and 6.2.7-1.el9_4.7 |
| CVSS base score | 7.5 (CVSS v3.1) |
| CVSS severity | High |
| Exploitation status | The two Redis advisories does not state that these flaws are being exploited. That is not confirmation that exploitation has not occurred. |
What Changed
CVE-2026-66373 concerns crafted RESTORE input; CVE-2026-81934 concerns a TLS pending-data use-after-free. Both published CVSS vectors require low privileges and high attack complexity. Keep those prerequisites distinct from generic network-restriction workaround wording.
What To Validate Now
- Inventory. Locate RHEL 9.2 and 9.4 extended-support Redis packages deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Compare each deployment with the authority's affected-version statement: The exact entitled RHEL 9.2 and 9.4 extended-support Redis packages builds before the branch-specific package, image, or digest listed by Red Hat. Do not infer applicability from product family or severity alone.
- Remediate. Use Redis 6.2.7-1.el9_2.7 on the covered RHEL 9.2 stream or 6.2.7-1.el9_4.7 on the covered RHEL 9.4 stream, or a superseding supported erratum. Do not change Redis major/module stream unintentionally.
- Validate. Read back installed RPM and running Redis versions on every node. Test normal client commands, TLS connections, persistence recovery and replication/failover using the approved procedure.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Restrict access to trusted Redis clients while arranging the update. Red Hat conditionally mentions disabling TLS when it is not required; do not remove required encryption as a blanket workaround. Test dependent applications, cluster recovery and rollback before broad rollout.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
