CVE-2026-92925 Overview
CVE-2026-92925 affects Redis community edition, where the cluster bus PING, PONG, and MEET packet parser fails to validate that string-carrying extensions are properly null-terminated. The parser checks extension padding and total length but stops short of enforcing terminator presence. A crafted packet triggers out-of-bounds reads when the payload is later consumed as a C string. Attackers on the same broadcast domain can leverage this weakness to leak process memory or crash the Redis node, producing remote denial of service. Redis Software and Redis Enterprise are not affected. The flaw is tracked under [CWE-125] (Out-of-Bounds Read).
Critical Impact
A single malformed cluster bus packet from an adjacent network attacker can read beyond intended buffer boundaries, exposing sensitive in-memory data or crashing the Redis process.
Affected Products
- Redis community edition (cluster mode enabled)
- Redis versions prior to 8.10.0
- Not affected: Redis Software and Redis Enterprise
Discovery Timeline
- 2026-09-17 - CVE CVE-2026-92925 published to NVD
- 2026-09-17 - Last updated in NVD database
Technical Details for CVE-2026-92925
Vulnerability Analysis
Redis cluster nodes exchange gossip messages through a dedicated cluster bus using PING, PONG, and MEET packets. These packets carry extensions that convey metadata such as shard identifiers and human-readable node names. The parser in src/cluster_legacy.c validates the extension header, padding alignment, and total packet length. It does not verify that string-typed extension payloads contain a terminating NUL byte within the declared bounds.
Downstream code consumes those payloads through standard C string functions like strlen. When no terminator exists inside the extension buffer, the read walks past the intended boundary until an incidental zero byte is found or the process faults. The result is either information disclosure of adjacent heap memory or an abort of the Redis process, depending on memory layout.
Root Cause
The root cause is missing bounds-aware string handling. The parser trusted attacker-controlled length fields to imply string safety and used strlen on buffers whose termination was never verified. Any string extension processed by helpers such as auxShardIdPresent inherited this assumption.
Attack Vector
Exploitation requires network access to the Redis cluster bus port, typically the data port plus 10000. Authentication is not required because cluster bus traffic is peer-to-peer gossip. An attacker positioned on an adjacent network segment sends a crafted PING, PONG, or MEET packet with a string extension whose payload lacks a null terminator. The receiving node parses the packet, passes the buffer to string routines, and reads beyond its bounds.
// Patch excerpt from src/cluster_legacy.c
}
int auxShardIdPresent(clusterNode *n) {
- return strlen(n->shard_id);
+ return strnlen(n->shard_id, CLUSTER_NAMELEN);
}
int auxHumanNodenameSetter(clusterNode *n, void *value, int length) {
Source: Redis commit 37894fa. The fix replaces strlen with strnlen bounded by CLUSTER_NAMELEN, ensuring the read cannot extend past the declared field size.
Detection Methods for CVE-2026-92925
Indicators of Compromise
- Unexpected SIGSEGV or abort messages in Redis logs referencing cluster bus parsing or clusterProcessPacket.
- Repeated cluster bus disconnects or node failover events without corresponding network faults.
- Inbound traffic to the cluster bus port from hosts that are not part of the declared cluster topology.
Detection Strategies
- Inspect Redis error and crash logs for stack traces implicating clusterProcessGossipSection, auxShardIdPresent, or extension parsing functions.
- Correlate node restart events with cluster bus packet captures to identify malformed PING, PONG, or MEET frames.
- Deploy network sensors that flag cluster bus packets originating outside the approved cluster IP allowlist.
Monitoring Recommendations
- Enable verbose cluster logging (cluster-announce-* diagnostics) on nodes running vulnerable Redis builds.
- Monitor process uptime and restart counters for Redis instances to catch denial-of-service patterns early.
- Alert on any cluster bus connection attempts from unexpected source addresses using firewall or IDS telemetry.
How to Mitigate CVE-2026-92925
Immediate Actions Required
- Upgrade Redis community edition to release 8.10.0 or later, which contains the null-terminator validation fix.
- Restrict cluster bus port access to known cluster member IP addresses through host or network firewalls.
- Audit which Redis deployments run in cluster mode and prioritize patching those exposed beyond the local subnet.
Patch Information
The fix is available in Redis 8.10.0 and merged via pull request #15263. The change replaces unbounded strlen calls with strnlen bounded by CLUSTER_NAMELEN for string-carrying cluster bus extensions. Full patch details are in commit 37894fa.
Workarounds
- Disable cluster mode where clustering is not required by running Redis in standalone configuration.
- Isolate the cluster bus on a dedicated management VLAN reachable only by trusted Redis peers.
- Enforce network ACLs on the cluster bus port (data port + 10000) to drop packets from non-member hosts.
# Example iptables rule restricting cluster bus port 16379 to known peers
iptables -A INPUT -p tcp --dport 16379 -s 10.0.0.11 -j ACCEPT
iptables -A INPUT -p tcp --dport 16379 -s 10.0.0.12 -j ACCEPT
iptables -A INPUT -p tcp --dport 16379 -s 10.0.0.13 -j ACCEPT
iptables -A INPUT -p tcp --dport 16379 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
