p PatchFirst

CVE-2026-92925

CVE-2026-92925 · Redis: redis: out-of-bounds read via crafted cluster bus packets

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-carrying extensions for null-termination. This oversight allows a remote attacker to craft a malicious packet, leading to an out-of-bounds read when the packet's payload is processed. Successful exploitation of this vulnerability could result in the disclosure of sensitive information or a remote denial of service (DoS).

CVSS 7.1 · High · EPSS 0.4% · Fix available

Published
Updated

Stack: system · database

Affected products and versions

  • red hat enterprise linux 9

    Versions
    • ≥ 9080020260821173335.9: Not affected (rpm)

    No fix published

  • red hat enterprise linux 9.4 update services for sap solutions

    Versions
    • ≥ 9040020260917140622.9: Not affected (rpm)

    No fix published

  • red hat enterprise linux 9.6 extended update support

    Versions
    • ≥ 9060020260917140656.9: Not affected (rpm)

    No fix published

  • pen drive powered by red hat lightspeed

    No fix published

  • red hat 3scale api management platform 2

    No fix published

  • red hat enterprise linux 10

    No fix published

  • red hat enterprise linux 8

    No fix published

  • red hat enterprise linux 9

    No fix published

  • red hat hardened images

    No fix published

  • redis Debian:12

    Versions
    • 5:7.0.11-1
    • 5:7.0.11-1+deb12u1
    • 5:7.0.12-1
    • 5:7.0.12-2
    • 5:7.0.13-1
    • 5:7.0.13-2
    • 5:7.0.14-1
    • 5:7.0.14-2
    • 5:7.0.15-1~deb12u1
    • 5:7.0.15-1~deb12u2
    • 5:7.0.15-1~deb12u3
    • 5:7.0.15-1~deb12u4
    • 5:7.0.15-1~deb12u5
    • 5:7.0.15-1~deb12u6
    • 5:7.0.15-1~deb12u7
    • 5:7.0.15-1~deb12u8
    • 5:7.0.15-1~deb12u9
    Affected ranges
    • ECOSYSTEM: < 5:7.0.15-1~deb12u10

    Update to 5:7.0.15-1~deb12u10

  • redis Debian:13

    Versions
    • 5:8.0.2-3
    • 5:8.0.2-3+deb13u1
    • 5:8.0.2-3+deb13u2
    • 5:8.0.2-3+deb13u3
    • 5:8.0.4-1
    • 5:8.0.5-1
    • 5:8.0.6-1
    • 5:8.0.6-2
    • 5:8.0.6-3
    • 5:8.4.0-1
    • 5:8.6.1-1
    • 5:8.6.2-1
    • 5:8.6.3-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • redis Debian:14

    Versions
    • 5:8.0.2-3
    • 5:8.0.4-1
    • 5:8.0.5-1
    • 5:8.0.6-1
    • 5:8.0.6-2
    Affected ranges
    • ECOSYSTEM: < 5:8.0.6-3

    Update to 5:8.0.6-3

  • redis Ubuntu:24.04:LTS

    Versions
    • 5:7.0.12-1
    • 5:7.0.14-1
    • 5:7.0.14-2
    • 5:7.0.15-1
    • 5:7.0.15-1build1
    • 5:7.0.15-1build2
    • 5:7.0.15-1ubuntu0.24.04.1
    • 5:7.0.15-1ubuntu0.24.04.2
    • 5:7.0.15-1ubuntu0.24.04.3
    • 5:7.0.15-1ubuntu0.24.04.4
    Affected ranges
    • ECOSYSTEM: < 5:7.0.15-1ubuntu0.24.04.5

    Update to 5:7.0.15-1ubuntu0.24.04.5

  • redis Ubuntu:26.04:LTS

    Versions
    • 5:8.0.2-3build1
    • 5:8.0.2-3ubuntu0.25.10.1
    • 5:8.0.5-1
    Affected ranges
    • ECOSYSTEM: < 5:8.0.5-1ubuntu0.1

    Update to 5:8.0.5-1ubuntu0.1

Original sources

Check your server →