CVE-2026-92925
A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-carrying extensions for null-termination. This oversight allows a remote attacker to craft a malicious packet, leading to an out-of-bounds read when the packet's payload is processed. Successful exploitation of this vulnerability could result in the disclosure of sensitive information or a remote denial of service (DoS).
Schwachstellenklasse
A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-carrying extensions for null-termination. This oversight allows a remote attacker to craft a malicious packet, leading to an out-of-bounds read when the packet's payload is processed. Successful exploitation of this vulnerability could result in the disclosure of sensitive information or a remote denial of service (DoS).
Quellen
- https://access.redhat.com/errata/RHSA-2026:65120
- https://access.redhat.com/errata/RHSA-2026:69520
- https://access.redhat.com/errata/RHSA-2026:69521
- https://access.redhat.com/security/cve/CVE-2026-92925
- https://bugzilla.redhat.com/show_bug.cgi?id=2535971
- https://github.com/redis/redis/commit/37894faeea11e2db28b9fc2af378a762d2c36523
Finden Sie die Schwachstelle, bevor es ein Angreifer tut.
Melden Sie sich mit GitHub an und starten Sie Ihr erstes Audit in weniger als einer Minute. Für den kostenlosen Plan ist keine Kreditkarte nötig.