CVE-2026-92925
HighCVSS 7.1Summary
A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-carrying extensions for null-termination. This oversight allows a remote attacker to craft a malicious packet, leading to an out-of-bounds read when the packet's payload is processed.
Risk Assessment
Successful exploitation of this vulnerability could result in the disclosure of sensitive information or a remote denial of service (DoS). The risk is high for Redis clusters exposed to untrusted networks.
Recommendation
Update Redis to a version containing the fix. Restrict access to the Redis cluster bus to trusted networks and nodes only.
Other vulnerabilities in Redis
See all- CVE-2016-10517High
Redis before version 3.2.7 is vulnerable to 'Cross Protocol Scripting' due to a lack of checks for POST and Host: strings, which are not valid in the Redis protocol.
- CVE-2015-8080High
Integer overflow in the getnum function in lua_struct.c in Redis 2.8.x before 2.8.24 and 3.0.x before 3.0.6 allows context-dependent attackers with permission to run Lua code in a Redis session to cause a denial of service (memory corruption and application crash) or possibly bypass intended sandbox restrictions via a large number, which triggers a stack-based buffer overflow.
- CVE-2015-4335High
Redis versions before 2.8.21 and 3.x before 3.0.2 allow remote attackers to execute arbitrary Lua bytecode via the eval command.
- CVE-2023-36824High
In Redis 7.0 prior to 7.0.12, a vulnerability exists that may lead to a heap overflow when extracting key names from a command and a list of arguments. This can result in reading random heap memory, heap corruption, and potentially remote code execution.
- CVE-2022-0543CriticalActively exploited
It was discovered that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.
- CVE-2017-15047Critical
The clusterLoadConfig function in Redis 4.0.2 allows attackers to cause a denial of service (out-of-bounds array index and application crash) by leveraging 'limited access to the machine'.
- CVE-2016-8339Critical
A buffer overflow in Redis versions 3.2.x prior to 3.2.4 can lead to arbitrary code execution when a crafted command is sent. An out of bounds write vulnerability exists in the handling of the client-output-buffer-limit option during the CONFIG SET command.
- CVE-2026-81934High
Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the privileges of the Redis server.
- CVE-2026-66373High
Redis before version 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer. Deleting both consumers via XGROUP DELCONSUMER leads to a double free. This issue exists because of an incomplete fix for CVE-2026-25243.
- CVE-2026-25243High
A vulnerability in Redis up to version 8.6.3 allows an authenticated attacker to execute remote code via crafted data in the RESTORE command due to improper validation of serialized values.
Original NVD description (English source)
A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-carrying extensions for null-termination. This oversight allows a remote attacker to craft a malicious packet, leading to an out-of-bounds read when the packet's payload is processed. Successful exploitation of this vulnerability could result in the disclosure of sensitive information or a remote denial of service (DoS).