CVE-2026-92925: 
Redis vulnerability analysis and mitigation

CVE-2026-92925 is an out-of-bounds read vulnerability in the Redis community (open source) cluster bus packet parser affecting Redis Open Source versions 7.0.0 through 8.8.1. The cluster bus PING/PONG/MEET packet parser validates extension padding and total length but fails to verify that string-carrying extensions (hostname and human-nodename) are properly null-terminated, allowing a remote attacker on the adjacent network to craft a malicious packet that triggers out-of-bounds reads when the payload is consumed as a C string. The vulnerability was disclosed on September 17, 2026, and is patched in Redis 8.10.0. It carries a CVSS v3.1 base score of 7.1 (High) and a CVSS v4.0 base score of 6.0 (Medium) (Github Advisory, Red Hat Bugzilla). Redis Software and Redis Enterprise are explicitly not affected by this issue.

The root cause is CWE-125 (Out-of-bounds Read) in src/cluster_legacy.c within the clusterProcessPacket function. The extension-validation loop checked padding alignment and total packet length but never verified that CLUSTERMSG_EXT_TYPE_HOSTNAME and CLUSTERMSG_EXT_TYPE_HUMAN_NODENAME extension data ends with a null byte ('\0'). When the extension payload is subsequently consumed as a C string (e.g., via strlen or string copy operations), the absence of a null terminator causes the parser to read beyond the intended buffer boundary. The fix, introduced in PR #15263 and commit 37894fa, adds an explicit check that datalen > 0 and str[datalen - 1] == '\0' for these extension types, rejecting non-conforming packets with a warning log and early return. Additionally, auxShardIdPresent was corrected to use strnlen with CLUSTER_NAMELEN instead of unbounded strlen (Redis PR #15263, Redis Commit).

Successful exploitation can result in two primary outcomes: disclosure of sensitive information from Redis process memory (confidentiality impact) or a remote denial of service causing the Redis service to crash (high availability impact). Because the cluster bus port is typically accessible only to adjacent cluster nodes, the attack surface is limited to the cluster network segment, reducing the risk of internet-scale exploitation. Integrity is not impacted, and there is no evidence of lateral movement capability or code execution risk from this vulnerability (Github Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (Github Advisory). The EPSS score is approximately 0.335% (Feedly data), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires network adjacency to the Redis cluster bus port (default: client port + 10000) and no authentication, but the CVSS v4.0 Attack Requirements metric is rated "Present," reflecting that the cluster must be deployed and the bus port reachable. No threat actor attribution has been reported.

1. Reconnaissance: Identify Redis cluster nodes with the cluster bus port exposed (default: Redis client port + 10000, e.g., port 16379 if client port is 6379) using network scanning tools such as Nmap targeting the adjacent network segment.
2. Craft malicious packet: Construct a raw Redis cluster bus PING packet with a CLUSTERMSG_EXT_TYPE_HOSTNAME or CLUSTERMSG_EXT_TYPE_HUMAN_NODENAME extension whose data payload does not end with a null byte ('\0'). The packet must include a valid cluster bus header (RCmb magic, correct total length, and CLUSTERMSG_FLAG0_EXT_DATA flag set).
3. Send packet to cluster bus port: Open a raw TCP connection to the target node's cluster bus port and transmit the crafted binary packet directly.
4. Trigger out-of-bounds read: The vulnerable clusterProcessPacket function processes the extension and passes the non-null-terminated buffer to C string functions, reading beyond the intended buffer boundary.
5. Achieve objective: Depending on memory layout, the out-of-bounds read may leak adjacent memory contents (sensitive data from Redis process memory) or cause a segmentation fault, crashing the Redis service and resulting in denial of service (Redis PR #15263, Redis Commit).

• Logs: Redis server log entries containing "missing null terminator" in the context of cluster bus packet processing (e.g., WARNING: Received PING packet with missing null terminator in extension type <N>); unexpected warning-level log entries from clusterProcessPacket referencing malformed extension packets.
• Network: Unexpected TCP connections to the Redis cluster bus port (client port + 10000) from hosts that are not legitimate cluster members; raw binary traffic to the cluster bus port with malformed or oversized extension payloads.
• Process: Unexpected Redis process crashes or restarts (segmentation faults) correlated with cluster bus traffic; core dump files generated by the Redis process.

The primary remediation is to upgrade Redis Open Source to version 8.10.0 or later, which includes the fix from commit 37894fa (Redis Release 8.10.0). Red Hat has issued security errata RHSA-2026:69520 and RHSA-2026:69521 for affected RHEL packages (Red Hat Bugzilla). As a network-level workaround, restrict access to the Redis cluster bus port (default: client port + 10000) using firewall rules or security groups so that only authorized cluster node IP addresses can connect. Redis Software and Redis Enterprise users are not affected and require no action.

Red Hat classified the vulnerability as high severity and promptly issued security errata for affected RHEL products within days of disclosure (Red Hat Bugzilla). Debian and SUSE also issued advisories and updated packages for their distributions. The vulnerability received routine coverage from Linux security aggregators and vulnerability databases, with no notable controversy or significant social media discussion observed.