Description

An out-of-bounds read vulnerability in Redis through 8.8.1 allows an adjacent unauthenticated attacker to cause denial of service or information disclosure by sending a specially crafted PING message to the Redis Cluster Bus port. The getPingExtLength() function in the cluster bus message parser does not validate extension length fields against the actual remaining buffer size, allowing an attacker-controlled packet to cause the parser to read beyond the allocated buffer boundary.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-10T11:17:29.373Z",
  "pubdate": "2026-08-10T11:17:29.373Z",
  "executiveSummary": "An out-of-bounds read vulnerability has been identified in Redis up to version 8.8.1, posing a significant risk to cluster deployments. This vulnerability stems from improper input validation within the cluster bus message parser, specifically failing to adequately verify extension length fields against the actual remaining buffer size. An adjacent, unauthenticated attacker capable of communicating with the Redis Cluster Bus port can exploit this flaw by transmitting a specially crafted PING message. Successful exploitation of this vulnerability can lead to a denial of service condition through application crashes or unintended information disclosure by reading adjacent memory contents. The attack vector requires network proximity to the cluster bus port but does not necessitate authentication or specific privileges, making it a critical concern for network-exposed Redis clusters. Remediation requires applying official patches or updates provided by the vendor, alongside strict network segmentation and access controls to limit exposure of the cluster bus port to trusted nodes only.",
  "technicalDetails": "The vulnerability resides in the cluster bus message parser of Redis, specifically within the getPingExtLength() function. The root cause of the issue is a failure in bounds checking, where the function parses extension length fields from incoming network packets without validating them against the actual remaining size of the allocated network buffer. When processing a specially crafted PING message, this lack of validation allows an attacker-controlled length field to direct the parser to read memory addresses beyond the legitimate boundaries of the allocated buffer.\nThe exploitation mechanism relies on network exposure to the Redis Cluster Bus port, which is typically used for node-to-node communication in a Redis Cluster configuration. An adjacent unauthenticated attacker crafts a malicious PING message containing manipulated extension length headers. Upon receipt, the vulnerable getPingExtLength() function processes the malicious payload, causing the internal parser to read out-of-bounds memory. Depending on the specific memory layout and subsequent handling of the read data, this behavior results in either a segmentation fault causing a denial of service or the leakage of sensitive stack or heap data back to the attacker or via error logs, leading to potential information disclosure."
}