CVE-2026-85219: Thinkst Canary OpenCanary DOS Vulnerability

CVE-2026-85219 Overview

CVE-2026-85219 is a denial-of-service vulnerability in the Redis module of Thinkst Canary's OpenCanary version 0.9.9. An unauthenticated remote attacker can trigger unconstrained memory usage against the affected service. The flaw is categorized under [CWE-770: Allocation of Resources Without Limits or Throttling]. Successful exploitation degrades availability of the OpenCanary honeypot host by exhausting memory resources.

Critical Impact
Unauthenticated attackers can consume unbounded memory on hosts running OpenCanary 0.9.9, leading to service degradation or process termination on the deployed honeypot.

Affected Products

Thinkst Canary OpenCanary 0.9.9
OpenCanary deployments exposing the Redis module to untrusted networks
Downstream distributions bundling OpenCanary 0.9.9

Discovery Timeline

2026-09-21 - CVE-2026-85219 published to the National Vulnerability Database (NVD)
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-85219

Vulnerability Analysis

OpenCanary emulates network services, including Redis, to detect adversary reconnaissance and lateral movement. The Redis module in version 0.9.9 accepts inbound protocol data without imposing bounds on buffered input. An attacker can send crafted Redis protocol messages that cause the module to allocate memory proportional to attacker-controlled input sizes.

Because no upper limit is enforced, sustained requests inflate resident memory until the process or host becomes unstable. The attack requires network reachability to the emulated Redis port but no authentication or user interaction. Exploitation reliability depends on host resources, which aligns with the reported high attack complexity.

Root Cause

The root cause is missing input size validation and resource throttling in the Redis protocol handler. The module allocates buffers to store parsed protocol elements without enforcing maximum command length, bulk string size, or aggregate memory ceilings. This maps directly to [CWE-770], where the application fails to constrain resource allocation triggered by external input.

Attack Vector

The attack vector is network-based. An unauthenticated remote attacker connects to the OpenCanary Redis listener and issues Redis protocol commands containing large bulk strings or repeated allocations. The absence of size checks causes the honeypot process to consume memory until it is killed by the operating system or the host stops servicing legitimate detections.

For technical details, refer to the GitHub Security Advisory GHSA-77jg-5rmj-77jx.

Detection Methods for CVE-2026-85219

Indicators of Compromise

Sudden growth in resident memory of the opencanaryd or Python process hosting the Redis module
OpenCanary process terminations logged by the OOM killer in /var/log/syslog or dmesg
Large or repeated inbound connections to the emulated Redis TCP port from a single source
Redis protocol messages with abnormally large bulk-string length prefixes

Detection Strategies

Monitor per-process memory metrics for the OpenCanary service and alert on rapid allocation trends
Inspect network flow records for high-volume traffic to the emulated Redis port originating from untrusted networks
Correlate OpenCanary alert logs with host telemetry to distinguish reconnaissance from resource-abuse patterns

Monitoring Recommendations

Enable host-level memory and process-restart alerting on all OpenCanary sensors
Forward OpenCanary logs and host metrics to a centralized log platform for retention and correlation
Track connection counts and byte volumes per source IP against honeypot listeners to identify abuse

How to Mitigate CVE-2026-85219

Immediate Actions Required

Restrict network exposure of the OpenCanary Redis module to trusted management or decoy segments only
Apply upstream patches from the Thinkst OpenCanary project once available for versions after 0.9.9
Disable the Redis module in the OpenCanary configuration if it is not required for detection coverage
Enforce per-source connection rate limits at the network or host firewall layer

Patch Information

Refer to the GitHub Security Advisory GHSA-77jg-5rmj-77jx for the authoritative fix guidance and updated release information from Thinkst. Upgrade OpenCanary to the fixed version identified in the advisory once published.

Workarounds

Set the Redis module to false in opencanary.conf to disable the vulnerable listener
Place OpenCanary sensors behind a firewall that permits only expected reconnaissance source ranges
Apply operating-system memory limits using systemd directives such as MemoryMax= on the OpenCanary service unit
Restart the OpenCanary service on a scheduled basis to reclaim memory pending an official patch

bash

# Configuration example: disable the Redis module in opencanary.conf
{
  "redis.enabled": false,
  "redis.port": 6379
}

# Example systemd override to cap process memory
# /etc/systemd/system/opencanary.service.d/limits.conf
[Service]
MemoryMax=512M
Restart=on-failure