CVE-2026-92925: Redis: redis: out-of-bounds read via crafted cluster bus packets
A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-carrying extensions for null-termination. This oversight allows a remote attacker to craft a malicious packet, leading to an out-of-bounds read when the packet's payload is processed. Successful exploitation of this vulnerability could result in the disclosure of sensitive information or a remote denial of service (DoS).
Other sources
In Redis community the cluster bus PING/PONG/MEET packet parser validated extension padding and total length but never checked that string-carrying extensions are properly null-terminated, allowing a crafted packet to trigger out-of-bounds reads when the payload is later consumed as a C string. This vulnerability can potentially lead to loss of confidentiality or remote denial of service. Redis Software / Redis Enterprise are not affected by this issue.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Which Redis deployments are affected?
The issue affects Redis community. Redis Software and Redis Enterprise are explicitly not affected.
What access does an attacker need to exploit this?
An attacker needs to send a crafted PING, PONG, or MEET packet to the Redis cluster bus so that a string-carrying extension lacks proper null termination.
What could successful exploitation cause?
Successful exploitation can potentially cause out-of-bounds reads, leading to loss of confidentiality or remote denial of service.
Which release includes the fix?
The provided release reference identifies Redis 8.10.0 as the release containing the fix.