Executive brief
Redis is an in-memory data store widely used for caching and session management in web applications. A flaw in Redis's cluster communication packet parser fails to properly validate packet contents, allowing a remote attacker to send a crafted packet that triggers an out-of-bounds memory read. This could expose sensitive data cached in Redis or cause the service to crash, disrupting applications that depend on it.
Technical details
The vulnerability is an out-of-bounds read in Redis's cluster bus packet parser, which handles PING, PONG, and MEET packets. The root cause is a failure to validate null-termination of string-carrying extensions in the packet payload. A remote attacker can craft a malicious cluster bus packet and send it to a Redis instance; no authentication is required if the instance is on a network accessible to the attacker. Successful exploitation results in out-of-bounds memory access, leading to information disclosure or denial of service. Patches are available in Redis 7.2.16 and later versions, as indicated by the Red Hat advisory RHSA-2026:65120.
Affected products
- Redis Redis before 7.2.16
Timeline
- 2026-09-17: disclosed
- 2026-09-08: patched: Red Hat advisory RHSA-2026:65120 released with fix in redis 7.2.16