CVE-2026-72568 in Redis
Summary
by MITRE • 08/10/2026
An out-of-bounds read vulnerability in Redis through 8.8.1 allows an adjacent unauthenticated attacker to cause denial of service or information disclosure by sending a specially crafted PING message to the Redis Cluster Bus port. The getPingExtLength() function in the cluster bus message parser does not validate extension length fields against the actual remaining buffer size, allowing an attacker-controlled packet to cause the parser to read beyond the allocated buffer boundary.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/10/2026
This vulnerability represents a critical out-of-bounds read flaw in Redis versions up to 8.8.1 that specifically targets the cluster bus message parsing functionality. The issue arises from insufficient input validation within the getPingExtLength() function which processes incoming PING messages on the Redis Cluster Bus port. An adjacent unauthenticated attacker can exploit this weakness by crafting malicious packets that manipulate the extension length fields in cluster bus messages, causing the parser to access memory beyond the allocated buffer boundaries.
The technical implementation of this vulnerability stems from a fundamental failure in bounds checking during message parsing operations. When the cluster bus receives a PING message, the getPingExtLength() function attempts to extract extension length information without verifying that the specified length does not exceed the remaining available buffer space. This validation gap creates an exploitable condition where attacker-controlled data can influence the parser's memory access patterns, potentially leading to information disclosure through memory content leakage or system instability causing denial of service.
From an operational impact perspective, this vulnerability poses significant risks to Redis deployments that utilize cluster functionality, particularly in environments where network segmentation is insufficient or where attackers can establish adjacent network positions. The unauthenticated nature of the attack means that any entity with access to the cluster bus port can potentially exploit this weakness without requiring prior authentication credentials. This makes the vulnerability particularly dangerous in cloud environments or containerized deployments where Redis instances may be exposed to untrusted networks.
The attack vector specifically targets the cluster bus communication port which is typically used for internal Redis cluster coordination messages including PING operations that maintain cluster membership and health status. When an attacker sends a malformed PING message with manipulated extension length fields, the parser's failure to validate buffer boundaries results in memory access violations that can manifest as system crashes or data leakage. This vulnerability aligns with CWE-129 which addresses insufficient validation of length fields, and represents a classic example of improper input validation leading to memory safety issues.
Security mitigations for this vulnerability should focus on immediate patching of Redis instances to versions that address the buffer boundary checking issue in the cluster bus message parser. Network segmentation strategies should be implemented to restrict access to cluster bus ports to trusted entities only, while also considering firewall rules that limit communication to specific IP ranges. Additionally, monitoring systems should be enhanced to detect anomalous PING message patterns that might indicate exploitation attempts. Organizations should also implement regular security assessments of their Redis deployments to identify and remediate similar validation gaps in other parsing functions. The ATT&CK framework categorizes this as a privilege escalation technique through memory corruption, where the initial access point is through adjacent network positioning rather than direct authentication bypass.
This vulnerability demonstrates the importance of robust input validation in network protocol implementations and highlights how seemingly minor parser validation gaps can create significant security risks in distributed systems. The fix typically involves implementing proper bounds checking before any buffer access operations, ensuring that extension length fields are validated against available buffer space before proceeding with memory reads. Organizations maintaining Redis clusters should prioritize this patch deployment as a critical security measure to protect against potential denial of service attacks and information disclosure threats targeting their caching infrastructure.