CVE-2026-92925: 
Redis vulnerability analysis and mitigation

CVE-2026-92925 is an out-of-bounds read vulnerability in Redis Open Source (community edition) affecting the cluster bus packet parser. The flaw exists in the clusterProcessPacket function, which handles PING, PONG, and MEET cluster bus messages but fails to verify that string-carrying extensions (hostname and human-nodename) are properly null-terminated. Affected versions span Redis Open Source 7.0.0 through 8.8.1; Redis Software and Redis Enterprise are explicitly not affected. The vulnerability was disclosed on September 17, 2026, with a fix merged into the Redis 8.10 release. It carries a CVSS v3.1 base score of 7.1 (High) and a CVSS v4.0 base score of 6.0 (Medium) (Github Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-125 (Out-of-bounds Read). In src/cluster_legacy.c, the extension-validation loop in clusterProcessPacket checked extension padding alignment and total packet length but never verified that CLUSTERMSG_EXT_TYPE_HOSTNAME and CLUSTERMSG_EXT_TYPE_HUMAN_NODENAME extension data ends with a null byte ('\0'). When the extension payload is subsequently consumed as a C string, the absence of null termination allows reads to continue beyond the intended buffer boundary. The fix (PR #15263, commit 37894fa) adds an explicit check requiring datalen > 0 and str[datalen - 1] == '\0'; packets failing this check are rejected with a warning log. Additionally, auxShardIdPresent was corrected to use strnlen with CLUSTER_NAMELEN instead of unbounded strlen (Redis PR #15263, Redis Commit). Exploitation requires adjacent network access to the Redis cluster bus port (typically port base_port + 10000) and no authentication, but does require specific deployment conditions (attack requirements: present) (Github Advisory).

Successful exploitation can result in two primary outcomes: disclosure of sensitive information from Redis process memory (confidentiality impact: low) or a remote denial of service causing the Redis service to crash (availability impact: high). An unauthenticated attacker with network adjacency to the cluster bus port can send a single crafted PING/PONG/MEET packet to trigger the out-of-bounds read. Integrity is not impacted, and there is no known path to code execution. Affected deployments include any Redis Open Source cluster node (versions 7.0.0–8.8.1) whose cluster bus port is reachable from an attacker-controlled host (Github Advisory, Red Hat Bugzilla).

As of the disclosure date (September 17, 2026), there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. NVD SSVC assessment classifies exploitation as "none" and the vulnerability as non-automatable. The attack vector is adjacent network only, limiting the attacker pool to those with access to the cluster bus network segment (Github Advisory, Red Hat Bugzilla).

1. Reconnaissance: Identify Redis cluster nodes with their cluster bus ports exposed (default: Redis port + 10000, e.g., port 16379 for a node on 6379). Use network scanning tools (e.g., nmap) to locate reachable cluster bus ports on the adjacent network segment.
2. Craft malicious packet: Construct a raw cluster bus PING packet with a CLUSTERMSG_EXT_TYPE_HOSTNAME extension whose data payload (e.g., 32 bytes of 'A') contains no null terminator ('\0'). Set the CLUSTERMSG_FLAG0_EXT_DATA flag and num_extensions = 1 in the header. The test code in tests/unit/cluster/hostnames.tcl (PR #15263) demonstrates this construction in Tcl.
3. Send packet to cluster bus port: Open a raw TCP connection (or TLS connection if the cluster uses TLS) to the target node's cluster bus port and transmit the crafted binary packet.
4. Trigger out-of-bounds read: The vulnerable clusterProcessPacket function processes the extension payload as a C string without null-termination validation, causing an out-of-bounds memory read. This may leak adjacent memory contents (potential information disclosure) or cause a crash (DoS) depending on memory layout (Redis PR #15263, Redis Commit).

• Logs: Redis server log entries containing "missing null terminator in extension type" in the cluster bus warning messages; unexpected LL_WARNING-level log entries from clusterProcessPacket referencing malformed PING/PONG/MEET packets.
• Network: Unexpected TCP connections to the Redis cluster bus port (base port + 10000) from hosts that are not known cluster peers; raw binary traffic to cluster bus ports that does not originate from legitimate cluster nodes.
• Process: Redis process crashes or unexpected restarts, particularly on cluster nodes; elevated error rates in cluster node communication logs coinciding with external connection attempts to the bus port (Redis PR #15263).

Upgrade Redis Open Source to version 8.10.0 or later, which includes the fix from commit 37894fa (PR #15263) (Redis 8.10.0 Release). As an immediate workaround, restrict network access to the Redis cluster bus port (default: Redis port + 10000) using host-based firewalls, network security groups, or ACLs so that only authorized cluster node IP addresses can reach the bus port — this eliminates the adjacent-network attack surface. Redis Software and Redis Enterprise users are not affected and require no action (Github Advisory, Red Hat Bugzilla).

Red Hat triaged the vulnerability as high severity and opened a tracking bug (BZ#2535971) covering multiple affected products including redis:7/redis on RHEL and several 3scale AMP2 components, while marking redis:6/redis and standalone redis packages as unaffected. The GitHub Advisory Database published the advisory on September 17, 2026, with a moderate severity rating based on the CVSS v4.0 score. No notable independent researcher commentary or significant social media discussion has been observed beyond standard vulnerability aggregator coverage (Red Hat Bugzilla, Github Advisory).