CVE-2026-72568: Redis Out-of-Bounds Read DoS Vulnerability

CVE-2026-72568 Overview

CVE-2026-72568 is an out-of-bounds read vulnerability in Redis through version 8.8.1. An adjacent unauthenticated attacker can trigger the flaw by sending a specially crafted PING message to the Redis Cluster Bus port. Successful exploitation causes denial of service or discloses information from adjacent memory regions.

The issue is categorized under [CWE-125] (Out-of-Bounds Read) and affects Redis deployments that expose the Cluster Bus port on a shared network segment. Because no authentication is required, any host on the adjacent network can reach the vulnerable code path.

Critical Impact
Adjacent unauthenticated attackers can crash Redis Cluster nodes and read out-of-bounds memory contents through crafted Cluster Bus PING messages.

Affected Products

Redis through 8.8.1
Redis Cluster deployments exposing the Cluster Bus port
Downstream distributions embedding Redis 8.8.1 or earlier

Discovery Timeline

2026-08-10 - CVE-2026-72568 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-72568

Vulnerability Analysis

The vulnerability resides in the Redis Cluster Bus message-handling logic. The Cluster Bus is an internal binary protocol used by Redis Cluster nodes to exchange gossip, failover, and heartbeat information. Nodes accept these messages on a dedicated port, typically the client port plus 10000.

When a node processes an inbound PING message, the parser reads fields from the attacker-supplied buffer without fully validating declared lengths against the actual payload size. A specially crafted PING frame causes the parser to read past the end of the allocated buffer.

The out-of-bounds read produces two distinct outcomes. If the read lands on unmapped memory, the Redis process crashes and cluster availability degrades. If the read succeeds, adjacent process memory is copied into subsequent protocol responses or log output, disclosing sensitive data such as keys, values, or internal pointers.

Root Cause

The root cause is insufficient bounds checking on length fields within Cluster Bus message headers. The parser trusts declared sizes rather than validating them against the received frame length, matching the [CWE-125] pattern.

Attack Vector

Exploitation requires adjacent network access to the Cluster Bus port and does not require authentication or user interaction. The attacker sends a malformed PING frame with manipulated length fields to trigger the read. See the Redis GitHub repository and the Redis official documentation for protocol details.

Detection Methods for CVE-2026-72568

Indicators of Compromise

Unexpected Redis process crashes or restarts on cluster nodes with SIGSEGV entries in system logs
Malformed Cluster Bus frames received on the cluster port (default client port + 10000)
Anomalous inbound connections to the Cluster Bus port from hosts outside the cluster topology
Redis log entries indicating cluster link disconnections or protocol errors during PING handling

Detection Strategies

Monitor Redis server logs for repeated cluster link failures or unexplained node fail-over events
Deploy network intrusion detection signatures for oversized or malformed Redis Cluster Bus frames
Baseline expected peers on the Cluster Bus port and alert on connections from unknown source addresses

Monitoring Recommendations

Enable verbose Redis logging and forward redis-server logs to a centralized SIEM for correlation
Track process availability and memory metrics on all Redis Cluster nodes for crash-loop patterns
Capture packet metadata on the Cluster Bus port to reconstruct malformed message activity

How to Mitigate CVE-2026-72568

Immediate Actions Required

Restrict the Redis Cluster Bus port to trusted cluster members using host firewalls or security groups
Isolate Redis Cluster nodes on a dedicated management network segment inaccessible to workloads and users
Enable TLS for Cluster Bus communication where supported to authenticate and integrity-check peer messages
Inventory Redis deployments and identify any node running version 8.8.1 or earlier for prioritized patching

Patch Information

At the time of publication, refer to the Redis GitHub repository for the most recent releases addressing versions through 8.8.1. Apply the vendor-supplied fix as soon as it is available and validate cluster health after upgrade.

Workarounds

Block external access to the Cluster Bus port at the perimeter and within east-west network policies
Bind Redis Cluster Bus to a private interface using cluster-announce-bus-port and network ACLs
Enforce network segmentation so only known cluster peers can reach the Cluster Bus port

bash

# Example iptables rule restricting Cluster Bus port 16379 to known peers
iptables -A INPUT -p tcp --dport 16379 -s 10.0.0.11 -j ACCEPT
iptables -A INPUT -p tcp --dport 16379 -s 10.0.0.12 -j ACCEPT
iptables -A INPUT -p tcp --dport 16379 -s 10.0.0.13 -j ACCEPT
iptables -A INPUT -p tcp --dport 16379 -j DROP