Source: redis X-Debbugs-CC: [email protected] Severity: important Tags: security
Hi, The following vulnerability was published for redis. CVE-2026-92925[0]: | A flaw was found in Redis community. The cluster bus packet parser, | responsible for handling PING, PONG, and MEET packets, fails to | properly validate string-carrying extensions for null-termination. | This oversight allows a remote attacker to craft a malicious packet, | leading to an out-of-bounds read when the packet's payload is | processed. Successful exploitation of this vulnerability could | result in the disclosure of sensitive information or a remote denial | of service (DoS). https://github.com/redis/redis/pull/15263 Fixed by: https://github.com/redis/redis/commit/37894faeea11e2db28b9fc2af378a762d2c36523 (8.10-rc1) If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-92925 https://www.cve.org/CVERecord?id=CVE-2026-92925 Please adjust the affected versions in the BTS as needed.
