CVE-2026-81934: Redis Tls Pending List Iter Uaf

Iterating over a pending TLS data list with `listIter` / `listNext` while calling `tlsHandleEvent` can cause a use-after-free vulnerability if event processing removes or frees list nodes. Dequeue or remove nodes prior to invoking the event callback.

Provally CuratedPublic repositoryHighMedium confidenceVerifiedApache-2.0C
greprules fetch cve-2026-81934-redis-tls-pending-list-iter-uaf --engine opengrep

Description

Iterating over a pending TLS data list with `listIter` / `listNext` while calling `tlsHandleEvent` can cause a use-after-free vulnerability if event processing removes or frees list nodes. Dequeue or remove nodes prior to invoking the event callback.