CVE-2026-72568: 
Redis vulnerability analysis and mitigation

CVE-2026-72568 is an out-of-bounds read vulnerability in Redis through version 8.8.1 that allows an adjacent unauthenticated attacker to cause denial of service or information disclosure by sending a specially crafted PING message to the Redis Cluster Bus port. It was published on August 10, 2026, and assigned a CVSS v3.1 base score of 7.1 (High) (GitHub Advisory). Notably, this CVE has been marked as Rejected by the Red Hat CNA-LR, which concluded the CVE is not valid (Feedly). Despite the rejection, the advisory was initially assigned by TuranSec and tracked under EUVD-2026-55238.

The vulnerability is classified as CWE-125 (Out-of-bounds Read), mapped to CAPEC-540 (Overread Buffers). According to the original description, the getPingExtLength() function in the Redis Cluster Bus message parser does not validate extension length fields against the actual remaining buffer size, allowing an attacker-controlled PING packet to cause the parser to read beyond the allocated buffer boundary (GitHub Advisory). The attack vector is adjacent network (AV:A), requires no privileges or user interaction, and has low attack complexity — meaning an attacker on the same network segment as the Redis Cluster Bus port could trigger the flaw without authentication. However, given the CVE's rejected status, the technical validity of these claims has not been confirmed by the Redis project or Red Hat.

If the vulnerability were valid, successful exploitation could result in denial of service (crashing the Redis service) or limited information disclosure by reading data from memory beyond the intended buffer boundary (GitHub Advisory). The confidentiality impact is rated Low and availability impact is rated High, with no integrity impact. The scope is limited to the affected Redis instance, with no scope change, reducing the risk of direct lateral movement — though memory disclosure could potentially expose sensitive cached data.

There is no evidence of a public proof-of-concept exploit or active in-the-wild exploitation (Feedly). The EPSS score is approximately 0.233% (14th percentile), indicating a low probability of exploitation in the near term. The NVD SSVC assessment also classifies exploitation as "none" and technical impact as "partial." Critically, this CVE has been formally rejected by Red Hat CNA-LR as not valid, which significantly reduces the credibility of any exploitation scenario. It is not listed in the CISA Known Exploited Vulnerabilities catalog.

Given that CVE-2026-72568 has been rejected as invalid by Red Hat CNA-LR, no specific patch is required in response to this CVE. However, as a general security best practice, organizations should restrict network access to the Redis Cluster Bus port (default: 16379) to trusted hosts only, implement network segmentation to limit adjacent network exposure, and keep Redis updated to the latest available release (GitHub Advisory). Monitoring access to the Cluster Bus port and enforcing firewall rules remain prudent defensive measures regardless of this CVE's status.

Red Hat CNA-LR formally rejected this CVE, concluding it is not valid — a significant authoritative statement that undermines the original advisory from TuranSec (Feedly). The GitHub Advisory Database lists the advisory as "Unreviewed" with no associated package or fixed version identified, further reflecting uncertainty around the vulnerability's legitimacy. A blog post referencing a "Redis heap OOB read" appeared on 1dayexploit.com shortly after publication, though its technical accuracy is unverified given the CVE's rejected status.