Out-of-Bounds Read Vulnerability in Redis Cluster Bus Packet Parser

CVE-2026-92925

What is CVE-2026-92925?

The Redis community version features a vulnerability in its cluster bus PING/PONG/MEET packet parser, where it failed to properly null-terminate strings carrying extensions. This oversight permits crafted packets to invoke out-of-bounds reads, which could compromise data confidentiality or result in a remote denial of service. It's crucial to apply updates from trusted sources to mitigate these risks effectively.

References