Out-of-Bounds Read Vulnerability in Redis Cluster Bus

A memory safety vulnerability, identified as CVE-2026-92925, exists in the Redis cluster bus packet parsing logic. The issue specifically resides in the handling of string-carrying extensions within cluster bus packets, including PING, PONG, and MEET packet types. The parser fails to ensure that these extensions are properly null-terminated before processing, which can lead to an out-of-bounds memory read when the application accesses the payload data. This vulnerability affects Redis deployments utilizing the cluster bus protocol. A remote, unauthenticated attacker can exploit this flaw by sending a specially crafted packet to a target Redis node, potentially crashing the service (denial of service) or causing the system to leak sensitive information stored in memory.

Impact

Successful exploitation of CVE-2026-92925 allows for remote denial of service or the exposure of sensitive memory contents. This impacts the availability and confidentiality of the affected Redis infrastructure. The vulnerability is critical for environments where Redis cluster instances are exposed to potentially untrusted network segments.

Recommendation

Prioritize patching Redis instances to the vendor-provided version that includes the fix for CVE-2026-92925. In environments where immediate patching is not possible, restrict network access to the Redis cluster bus port (default port 16379) to authorized internal nodes only using network-level access control lists (ACLs) to mitigate potential remote exploitation.