CVE-2026-92925 in Redis
Summary
by MITRE • 09/17/2026
In Redis community the cluster bus PING/PONG/MEET packet parser validated extension padding and total length but never checked that string-carrying extensions are properly null-terminated, allowing a crafted packet to trigger out-of-bounds reads when the payload is later consumed as a C string. This vulnerability can potentially lead to loss of confidentiality or remote denial of service. Redis Software / Redis Enterprise are not affected by this issue.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The identified vulnerability resides within the cluster bus implementation of the Redis server, specifically affecting the parsing logic for PING, PONG, and MEET control packets. These packet types serve as critical components in maintaining cluster health, node discovery, and inter-node communication. The core technical flaw stems from an insufficient validation mechanism during the processing of extension padding fields within these packets. While the parser correctly validates the total length of the incoming data to prevent buffer overflows associated with oversized payloads, it fails to verify that string-carrying extensions are properly null-terminated before they are consumed as C-style strings by subsequent functions in the codebase. This oversight creates a scenario where an attacker can craft malicious packets containing extension fields that lack the required terminating null byte.
When such a crafted packet is received and processed, the application attempts to read the string data until it encounters a null terminator. Because the padding or extension payload does not contain this expected delimiter within the allocated buffer boundaries, the memory access routine continues reading beyond the intended end of the buffer. This results in an out-of-bounds read operation, allowing the attacker to potentially leak sensitive information from adjacent memory regions that should remain inaccessible. The severity of this issue is compounded by its potential impact on confidentiality and system availability. An attacker could exploit this flaw to extract internal server state or configuration details, leading to a loss of confidentiality. Furthermore, if the out-of-bounds read triggers an exception or causes undefined behavior in critical cluster management routines, it can lead to a remote denial of service condition where the Redis instance becomes unresponsive or crashes entirely.
This vulnerability is classified under CWE-125, which describes Out-of-Bounds Read vulnerabilities, indicating that the software reads data past the end or before the beginning of the intended buffer. In terms of offensive security frameworks, this flaw aligns with MITRE ATT&CK technique T1046, Network Service Discovery, as it allows an attacker to probe and gather information about the internal structure and state of a network service without direct authentication in some cluster configurations. It also relates to CWE-20, Improper Input Validation, specifically regarding the failure to validate string termination characters when processing external input that is subsequently interpreted as C strings.
It is crucial to note that this vulnerability affects only specific versions of Redis OSS (Open Source Software) and does not impact Redis Enterprise or other commercial variants which may employ different architectural safeguards or patching strategies. To mitigate this risk, administrators running affected community editions must apply the latest security patches provided by the Redis team immediately. Until updates are applied, network-level controls such as firewalls should be configured to restrict access to the cluster bus port (typically 16379) exclusively from trusted internal nodes that participate in the cluster. This limits the attack surface by preventing untrusted external actors from sending crafted PING, PONG, or MEET packets directly to the vulnerable service components.