Description

Denial-of-Service in Redis module in Thinkst Canary's OpenCanary 0.9.9 allows an unauthenticated remote attacker cause unconstrained memory usage.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-09-21T20:17:36.807Z",
  "pubdate": "2026-09-21T20:17:36.807Z",
  "executiveSummary": "A critical memory exhaustion vulnerability exists within the Redis module of OpenCanary version 0.9.9, allowing for a Denial-of-Service (DoS) condition.\nThe vulnerability type is categorized as uncontrolled resource consumption, specifically affecting memory allocation routines. An unauthenticated remote attacker can exploit this flaw by sending specifically crafted network traffic to the Redis-based service.\nSuccessful exploitation results in the depletion of system memory, leading to the crash of the OpenCanary process or systemic instability, effectively rendering the honeypot service unavailable.\nThis vulnerability carries significant risk as it does not require authentication or elevated privileges, making it accessible to any remote actor capable of establishing a network connection to the service port.\nThe inherent design of the affected module fails to implement necessary constraints or rate-limiting on incoming data processing, directly facilitating the attack.\nOrganizations relying on OpenCanary 0.9.9 for threat detection should treat this as a high-priority risk, as the service's primary function—capturing telemetry—is nullified upon exploitation.",
  "technicalDetails": "The vulnerability resides in the Redis integration module of OpenCanary 0.9.9. The flaw is rooted in an improper handling of input buffers during the ingestion process, where the application fails to enforce size limits on incoming data streams.\nWhen the Redis module receives a request, it performs memory allocation based on input headers or packet contents without validating that the requested size aligns with available system resources or predefined safety thresholds.\nAn unauthenticated attacker can initiate a remote connection to the OpenCanary Redis port and transmit a sequence of malicious data packets designed to trigger large-scale memory allocations. Because the application logic does not impose a maximum buffer size or enforce strict length validation, the process continues to allocate heap memory until the operating system encounters an Out-Of-Memory (OOM) state.\nThe attack flow follows a structured trajectory: First, the attacker identifies the target OpenCanary instance and establishes a standard TCP connection to the Redis listener port. Second, the attacker transmits the malicious payload designed to induce unbounded memory growth. Third, the internal memory management routines of the Python-based OpenCanary service attempt to fulfill the request, consuming system RAM linearly.\nThis behavior facilitates a classic resource exhaustion attack. Once the allocated memory exceeds physical or configured limits, the Python interpreter either terminates due to a MemoryError or the kernel invokes the OOM killer, terminating the OpenCanary process. This results in an immediate service disruption.\nSince the module lacks authentication hooks for the Redis listener, the attack surface is exposed to any network entity that can reach the listener port, bypassing typical security barriers that would otherwise mitigate unauthorized interaction.\nThe lack of sanitization and flow control in the module's packet handling logic is the primary technical failure point. Post-exploitation impact is limited to service availability, as there is no evidence of arbitrary code execution; however, the resulting service downtime inhibits the detection and logging capabilities of the Canary deployment, potentially masking concurrent attacker activities."
}