CVE-2026-92925: Out-of-Bounds Read in Cluster Bus
In Redis community the cluster bus PING/PONG/MEET packet parser validated extension padding and total length but never checked that string-carrying extensions are properly null-terminated, allowing a crafted packet to trigger out-of-bounds reads when the payload is later consumed as a C string. This vulnerability can potentially lead to loss of confidentiality or remote denial of service. Redis Software / Redis Enterprise are not affected by this issue.
Affected Software
Event History
Frequently Asked Questions
Which Redis deployments are affected?
The issue affects Redis community. Redis Software and Redis Enterprise are explicitly not affected.
What access does an attacker need to exploit this?
An attacker needs to send a crafted PING, PONG, or MEET packet to the Redis cluster bus so that a string-carrying extension lacks proper null termination.
What could successful exploitation cause?
Successful exploitation can potentially cause out-of-bounds reads, leading to loss of confidentiality or remote denial of service.
Which release includes the fix?
The provided release reference identifies Redis 8.10.0 as the release containing the fix.