{
	"document":{
		"aggregate_severity":{
			"namespace":"https://nvd.nist.gov/vuln-metrics/cvss",
			"text":"High"
		},
		"category":"csaf_vex",
		"csaf_version":"2.0",
		"distribution":{
			"tlp":{
				"label":"WHITE",
				"url":"https:/www.first.org/tlp/"
			}
		},
		"lang":"en",
		"notes":[
			{
				"text":"redis security update",
				"category":"general",
				"title":"Synopsis"
			},
			{
				"text":"An update for redis is now available for openEuler-24.03-LTS-SP3",
				"category":"general",
				"title":"Summary"
			},
			{
				"text":"Redis is an advanced key-value store. It is often referred to as a dattructure server since keys can contain strings, hashes ,lists, sets anorted sets.\n\nSecurity Fix(es):\n\nIn the Linux kernel, the following vulnerability has been resolved: cifs: Fix missing credit release on failure in cifs_issue_read() Fix missing release of credits in the failure path in cifs_issue_read() lest retrying the subreq just overwrites the credits value.(CVE-2026-62356)\n\nRedis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the privileges of the Redis server. Fixed in Redis 8.2.9, 8.4.6, 8.6.6, 8.8.2, and 8.10.1.(CVE-2026-81934)\n\nA vulnerability, which was classified as critical, was found in Redis up to 8.8.1/8.9.x.CWE is classifying the issue as CWE-125. The product reads data past the end, or before the beginning, of the intended buffer.This is going to have an impact on confidentiality, integrity, and availability.Upgrading to version 8.10.0 eliminates this vulnerability.(CVE-2026-92925)",
				"category":"general",
				"title":"Description"
			},
			{
				"text":"An update for redis is now available for openEuler-24.03-LTS-SP3.\n\nopenEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.",
				"category":"general",
				"title":"Topic"
			},
			{
				"text":"High",
				"category":"general",
				"title":"Severity"
			},
			{
				"text":"redis",
				"category":"general",
				"title":"Affected Component"
			}
		],
		"publisher":{
			"issuing_authority":"openEuler security committee",
			"name":"openEuler",
			"namespace":"https://www.openeuler.org",
			"contact_details":"openeuler-security@openeuler.org",
			"category":"vendor"
		},
		"references":[
			{
				"summary":"openEuler-SA-2026-4402",
				"category":"self",
				"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4402"
			},
			{
				"summary":"CVE-2026-62356",
				"category":"self",
				"url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-62356&packageName=redis"
			},
			{
				"summary":"CVE-2026-81934",
				"category":"self",
				"url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-81934&packageName=redis"
			},
			{
				"summary":"CVE-2026-92925",
				"category":"self",
				"url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-92925&packageName=redis"
			},
			{
				"summary":"nvd cve",
				"category":"external",
				"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62356"
			},
			{
				"summary":"nvd cve",
				"category":"external",
				"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81934"
			},
			{
				"summary":"nvd cve",
				"category":"external",
				"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92925"
			},
			{
				"summary":"openEuler-SA-2026-4402 vex file",
				"category":"self",
				"url":"https://repo.openeuler.org/security/data/csaf/advisories/2026/csaf-openeuler-sa-2026-4402.json"
			}
		],
		"title":"An update for redis is now available for openEuler-24.03-LTS-SP3",
		"tracking":{
			"initial_release_date":"2026-10-22T09:29:09+08:00",
			"revision_history":[
				{
					"date":"2026-10-22T09:29:09+08:00",
					"summary":"Initial",
					"number":"1.0.0"
				}
			],
			"generator":{
				"date":"2026-10-22T09:29:09+08:00",
				"engine":{
					"name":"openEuler CSAF Tool V1.0"
				}
			},
			"current_release_date":"2026-10-22T09:29:09+08:00",
			"id":"openEuler-SA-2026-4402",
			"version":"1.0.0",
			"status":"final"
		}
	},
	"product_tree":{
		"branches":[
			{
				"name":"openEuler",
				"category":"vendor",
				"branches":[
					{
						"name":"openEuler",
						"branches":[
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP3"
									},
									"product_id":"openEuler-24.03-LTS-SP3",
									"name":"openEuler-24.03-LTS-SP3"
								},
								"name":"openEuler-24.03-LTS-SP3",
								"category":"product_version"
							}
						],
						"category":"product_name"
					},
					{
						"name":"aarch64",
						"branches":[
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP3"
									},
									"product_id":"redis-7.2.16-2.oe2403sp3.aarch64.rpm",
									"name":"redis-7.2.16-2.oe2403sp3.aarch64.rpm"
								},
								"name":"redis-7.2.16-2.oe2403sp3.aarch64.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP3"
									},
									"product_id":"redis-debuginfo-7.2.16-2.oe2403sp3.aarch64.rpm",
									"name":"redis-debuginfo-7.2.16-2.oe2403sp3.aarch64.rpm"
								},
								"name":"redis-debuginfo-7.2.16-2.oe2403sp3.aarch64.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP3"
									},
									"product_id":"redis-debugsource-7.2.16-2.oe2403sp3.aarch64.rpm",
									"name":"redis-debugsource-7.2.16-2.oe2403sp3.aarch64.rpm"
								},
								"name":"redis-debugsource-7.2.16-2.oe2403sp3.aarch64.rpm",
								"category":"product_version"
							}
						],
						"category":"architecture"
					},
					{
						"name":"src",
						"branches":[
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP3"
									},
									"product_id":"redis-7.2.16-2.oe2403sp3.src.rpm",
									"name":"redis-7.2.16-2.oe2403sp3.src.rpm"
								},
								"name":"redis-7.2.16-2.oe2403sp3.src.rpm",
								"category":"product_version"
							}
						],
						"category":"architecture"
					},
					{
						"name":"x86_64",
						"branches":[
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP3"
									},
									"product_id":"redis-7.2.16-2.oe2403sp3.x86_64.rpm",
									"name":"redis-7.2.16-2.oe2403sp3.x86_64.rpm"
								},
								"name":"redis-7.2.16-2.oe2403sp3.x86_64.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP3"
									},
									"product_id":"redis-debuginfo-7.2.16-2.oe2403sp3.x86_64.rpm",
									"name":"redis-debuginfo-7.2.16-2.oe2403sp3.x86_64.rpm"
								},
								"name":"redis-debuginfo-7.2.16-2.oe2403sp3.x86_64.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP3"
									},
									"product_id":"redis-debugsource-7.2.16-2.oe2403sp3.x86_64.rpm",
									"name":"redis-debugsource-7.2.16-2.oe2403sp3.x86_64.rpm"
								},
								"name":"redis-debugsource-7.2.16-2.oe2403sp3.x86_64.rpm",
								"category":"product_version"
							}
						],
						"category":"architecture"
					}
				]
			}
		],
		"relationships":[
			{
				"relates_to_product_reference":"openEuler-24.03-LTS-SP3",
				"product_reference":"redis-7.2.16-2.oe2403sp3.aarch64.rpm",
				"full_product_name":{
					"product_id":"openEuler-24.03-LTS-SP3:redis-7.2.16-2.oe2403sp3.aarch64",
					"name":"redis-7.2.16-2.oe2403sp3.aarch64 as a component of openEuler-24.03-LTS-SP3"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-24.03-LTS-SP3",
				"product_reference":"redis-debuginfo-7.2.16-2.oe2403sp3.aarch64.rpm",
				"full_product_name":{
					"product_id":"openEuler-24.03-LTS-SP3:redis-debuginfo-7.2.16-2.oe2403sp3.aarch64",
					"name":"redis-debuginfo-7.2.16-2.oe2403sp3.aarch64 as a component of openEuler-24.03-LTS-SP3"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-24.03-LTS-SP3",
				"product_reference":"redis-debugsource-7.2.16-2.oe2403sp3.aarch64.rpm",
				"full_product_name":{
					"product_id":"openEuler-24.03-LTS-SP3:redis-debugsource-7.2.16-2.oe2403sp3.aarch64",
					"name":"redis-debugsource-7.2.16-2.oe2403sp3.aarch64 as a component of openEuler-24.03-LTS-SP3"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-24.03-LTS-SP3",
				"product_reference":"redis-7.2.16-2.oe2403sp3.src.rpm",
				"full_product_name":{
					"product_id":"openEuler-24.03-LTS-SP3:redis-7.2.16-2.oe2403sp3.src",
					"name":"redis-7.2.16-2.oe2403sp3.src as a component of openEuler-24.03-LTS-SP3"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-24.03-LTS-SP3",
				"product_reference":"redis-7.2.16-2.oe2403sp3.x86_64.rpm",
				"full_product_name":{
					"product_id":"openEuler-24.03-LTS-SP3:redis-7.2.16-2.oe2403sp3.x86_64",
					"name":"redis-7.2.16-2.oe2403sp3.x86_64 as a component of openEuler-24.03-LTS-SP3"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-24.03-LTS-SP3",
				"product_reference":"redis-debuginfo-7.2.16-2.oe2403sp3.x86_64.rpm",
				"full_product_name":{
					"product_id":"openEuler-24.03-LTS-SP3:redis-debuginfo-7.2.16-2.oe2403sp3.x86_64",
					"name":"redis-debuginfo-7.2.16-2.oe2403sp3.x86_64 as a component of openEuler-24.03-LTS-SP3"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-24.03-LTS-SP3",
				"product_reference":"redis-debugsource-7.2.16-2.oe2403sp3.x86_64.rpm",
				"full_product_name":{
					"product_id":"openEuler-24.03-LTS-SP3:redis-debugsource-7.2.16-2.oe2403sp3.x86_64",
					"name":"redis-debugsource-7.2.16-2.oe2403sp3.x86_64 as a component of openEuler-24.03-LTS-SP3"
				},
				"category":"default_component_of"
			}
		]
	},
	"vulnerabilities":[
		{
			"cve":"CVE-2026-62356",
			"notes":[
				{
					"text":"In the Linux kernel, the following vulnerability has been resolved: cifs: Fix missing credit release on failure in cifs_issue_read() Fix missing release of credits in the failure path in cifs_issue_read() lest retrying the subreq just overwrites the credits value.",
					"category":"description",
					"title":"Vulnerability Description"
				}
			],
			"product_status":{
				"fixed":[
					"openEuler-24.03-LTS-SP3:redis-7.2.16-2.oe2403sp3.aarch64",
					"openEuler-24.03-LTS-SP3:redis-debuginfo-7.2.16-2.oe2403sp3.aarch64",
					"openEuler-24.03-LTS-SP3:redis-debugsource-7.2.16-2.oe2403sp3.aarch64",
					"openEuler-24.03-LTS-SP3:redis-7.2.16-2.oe2403sp3.src",
					"openEuler-24.03-LTS-SP3:redis-7.2.16-2.oe2403sp3.x86_64",
					"openEuler-24.03-LTS-SP3:redis-debuginfo-7.2.16-2.oe2403sp3.x86_64",
					"openEuler-24.03-LTS-SP3:redis-debugsource-7.2.16-2.oe2403sp3.x86_64"
				]
			},
			"remediations":[
				{
					"product_ids":[
						"openEuler-24.03-LTS-SP3:redis-7.2.16-2.oe2403sp3.aarch64",
						"openEuler-24.03-LTS-SP3:redis-debuginfo-7.2.16-2.oe2403sp3.aarch64",
						"openEuler-24.03-LTS-SP3:redis-debugsource-7.2.16-2.oe2403sp3.aarch64",
						"openEuler-24.03-LTS-SP3:redis-7.2.16-2.oe2403sp3.src",
						"openEuler-24.03-LTS-SP3:redis-7.2.16-2.oe2403sp3.x86_64",
						"openEuler-24.03-LTS-SP3:redis-debuginfo-7.2.16-2.oe2403sp3.x86_64",
						"openEuler-24.03-LTS-SP3:redis-debugsource-7.2.16-2.oe2403sp3.x86_64"
					],
					"details":"redis security update",
					"category":"vendor_fix",
					"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4402"
				}
			],
			"scores":[
				{
					"cvss_v3":{
						"baseSeverity":"HIGH",
						"baseScore":7.5,
						"vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
						"version":"3.1"
					},
					"products":[
						"openEuler-24.03-LTS-SP3:redis-7.2.16-2.oe2403sp3.aarch64",
						"openEuler-24.03-LTS-SP3:redis-debuginfo-7.2.16-2.oe2403sp3.aarch64",
						"openEuler-24.03-LTS-SP3:redis-debugsource-7.2.16-2.oe2403sp3.aarch64",
						"openEuler-24.03-LTS-SP3:redis-7.2.16-2.oe2403sp3.src",
						"openEuler-24.03-LTS-SP3:redis-7.2.16-2.oe2403sp3.x86_64",
						"openEuler-24.03-LTS-SP3:redis-debuginfo-7.2.16-2.oe2403sp3.x86_64",
						"openEuler-24.03-LTS-SP3:redis-debugsource-7.2.16-2.oe2403sp3.x86_64"
					]
				}
			],
			"threats":[
				{
					"details":"High",
					"category":"impact"
				}
			],
			"title":"CVE-2026-62356"
		},
		{
			"cve":"CVE-2026-81934",
			"notes":[
				{
					"text":"Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the privileges of the Redis server. Fixed in Redis 8.2.9, 8.4.6, 8.6.6, 8.8.2, and 8.10.1.",
					"category":"description",
					"title":"Vulnerability Description"
				}
			],
			"product_status":{
				"fixed":[
					"openEuler-24.03-LTS-SP3:redis-7.2.16-2.oe2403sp3.aarch64",
					"openEuler-24.03-LTS-SP3:redis-debuginfo-7.2.16-2.oe2403sp3.aarch64",
					"openEuler-24.03-LTS-SP3:redis-debugsource-7.2.16-2.oe2403sp3.aarch64",
					"openEuler-24.03-LTS-SP3:redis-7.2.16-2.oe2403sp3.src",
					"openEuler-24.03-LTS-SP3:redis-7.2.16-2.oe2403sp3.x86_64",
					"openEuler-24.03-LTS-SP3:redis-debuginfo-7.2.16-2.oe2403sp3.x86_64",
					"openEuler-24.03-LTS-SP3:redis-debugsource-7.2.16-2.oe2403sp3.x86_64"
				]
			},
			"remediations":[
				{
					"product_ids":[
						"openEuler-24.03-LTS-SP3:redis-7.2.16-2.oe2403sp3.aarch64",
						"openEuler-24.03-LTS-SP3:redis-debuginfo-7.2.16-2.oe2403sp3.aarch64",
						"openEuler-24.03-LTS-SP3:redis-debugsource-7.2.16-2.oe2403sp3.aarch64",
						"openEuler-24.03-LTS-SP3:redis-7.2.16-2.oe2403sp3.src",
						"openEuler-24.03-LTS-SP3:redis-7.2.16-2.oe2403sp3.x86_64",
						"openEuler-24.03-LTS-SP3:redis-debuginfo-7.2.16-2.oe2403sp3.x86_64",
						"openEuler-24.03-LTS-SP3:redis-debugsource-7.2.16-2.oe2403sp3.x86_64"
					],
					"details":"redis security update",
					"category":"vendor_fix",
					"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4402"
				}
			],
			"scores":[
				{
					"cvss_v3":{
						"baseSeverity":"HIGH",
						"baseScore":7.5,
						"vectorString":"CVSS:3.1/AV:A/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
						"version":"3.1"
					},
					"products":[
						"openEuler-24.03-LTS-SP3:redis-7.2.16-2.oe2403sp3.aarch64",
						"openEuler-24.03-LTS-SP3:redis-debuginfo-7.2.16-2.oe2403sp3.aarch64",
						"openEuler-24.03-LTS-SP3:redis-debugsource-7.2.16-2.oe2403sp3.aarch64",
						"openEuler-24.03-LTS-SP3:redis-7.2.16-2.oe2403sp3.src",
						"openEuler-24.03-LTS-SP3:redis-7.2.16-2.oe2403sp3.x86_64",
						"openEuler-24.03-LTS-SP3:redis-debuginfo-7.2.16-2.oe2403sp3.x86_64",
						"openEuler-24.03-LTS-SP3:redis-debugsource-7.2.16-2.oe2403sp3.x86_64"
					]
				}
			],
			"threats":[
				{
					"details":"High",
					"category":"impact"
				}
			],
			"title":"CVE-2026-81934"
		},
		{
			"cve":"CVE-2026-92925",
			"notes":[
				{
					"text":"A vulnerability, which was classified as critical, was found in Redis up to 8.8.1/8.9.x.CWE is classifying the issue as CWE-125. The product reads data past the end, or before the beginning, of the intended buffer.This is going to have an impact on confidentiality, integrity, and availability.Upgrading to version 8.10.0 eliminates this vulnerability.",
					"category":"description",
					"title":"Vulnerability Description"
				}
			],
			"product_status":{
				"fixed":[
					"openEuler-24.03-LTS-SP3:redis-7.2.16-2.oe2403sp3.aarch64",
					"openEuler-24.03-LTS-SP3:redis-debuginfo-7.2.16-2.oe2403sp3.aarch64",
					"openEuler-24.03-LTS-SP3:redis-debugsource-7.2.16-2.oe2403sp3.aarch64",
					"openEuler-24.03-LTS-SP3:redis-7.2.16-2.oe2403sp3.src",
					"openEuler-24.03-LTS-SP3:redis-7.2.16-2.oe2403sp3.x86_64",
					"openEuler-24.03-LTS-SP3:redis-debuginfo-7.2.16-2.oe2403sp3.x86_64",
					"openEuler-24.03-LTS-SP3:redis-debugsource-7.2.16-2.oe2403sp3.x86_64"
				]
			},
			"remediations":[
				{
					"product_ids":[
						"openEuler-24.03-LTS-SP3:redis-7.2.16-2.oe2403sp3.aarch64",
						"openEuler-24.03-LTS-SP3:redis-debuginfo-7.2.16-2.oe2403sp3.aarch64",
						"openEuler-24.03-LTS-SP3:redis-debugsource-7.2.16-2.oe2403sp3.aarch64",
						"openEuler-24.03-LTS-SP3:redis-7.2.16-2.oe2403sp3.src",
						"openEuler-24.03-LTS-SP3:redis-7.2.16-2.oe2403sp3.x86_64",
						"openEuler-24.03-LTS-SP3:redis-debuginfo-7.2.16-2.oe2403sp3.x86_64",
						"openEuler-24.03-LTS-SP3:redis-debugsource-7.2.16-2.oe2403sp3.x86_64"
					],
					"details":"redis security update",
					"category":"vendor_fix",
					"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4402"
				}
			],
			"scores":[
				{
					"cvss_v3":{
						"baseSeverity":"HIGH",
						"baseScore":7.1,
						"vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
						"version":"3.1"
					},
					"products":[
						"openEuler-24.03-LTS-SP3:redis-7.2.16-2.oe2403sp3.aarch64",
						"openEuler-24.03-LTS-SP3:redis-debuginfo-7.2.16-2.oe2403sp3.aarch64",
						"openEuler-24.03-LTS-SP3:redis-debugsource-7.2.16-2.oe2403sp3.aarch64",
						"openEuler-24.03-LTS-SP3:redis-7.2.16-2.oe2403sp3.src",
						"openEuler-24.03-LTS-SP3:redis-7.2.16-2.oe2403sp3.x86_64",
						"openEuler-24.03-LTS-SP3:redis-debuginfo-7.2.16-2.oe2403sp3.x86_64",
						"openEuler-24.03-LTS-SP3:redis-debugsource-7.2.16-2.oe2403sp3.x86_64"
					]
				}
			],
			"threats":[
				{
					"details":"High",
					"category":"impact"
				}
			],
			"title":"CVE-2026-92925"
		}
	]
}