Redis vulnerabilities and fixes

CVEs that mention Redis, ranked by priority. 9 tracked.

Redis has 9 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 5. Most recent: 2026-10-21. Highest priority: CVE-2026-75854 (score 60/100).

• CVE-2026-75854 CRITICAL 9.8 ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability in the Redis wire-protocol plug
• CVE-2026-35052 CRITICAL 9.8 UPGRADE D-Tale is the combination of a Flask back-end and a React front-end to view & analyze Pandas data structures
• CVE-2026-114087 HIGH 8.1 Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/
• CVE-2026-34501 HIGH 7.5 UPGRADE Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client. This issue affects
• CVE-2026-47769 MEDIUM 5.3 APIFold reads an OpenAPI 3.x or Swagger 2.x specification and generates a live, production-ready MCP server en
• CVE-2026-92209 HIGH 7.8 NoMachine Redis Improper Authentication Local Privilege Escalation Vulnerability
• CVE-2026-56388 HIGH n/a The Redis server command parser in Apache bRPC accepts an empty RESP array as a command header
• CVE-2026-58064 HIGH n/a The Redis protocol implementation in Apache bRPC allowed inline command parsing to allocate and copy the full
• CVE-2026-54426 HIGH n/a Uncontrolled recursion in the Redis reply parser in Apache bRPC < 1.18.0 allows a remote Redis server peer to

FAQ

How do I fix Redis vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Redis being exploited right now?

None of the tracked Redis CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which Redis CVE should I patch first?

CVE-2026-75854 currently ranks highest (60/100): ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability in the Redis wire-protocol plug.

← Back to latest CVEs