Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-92925— Redis: redis: out-of-bounds read via crafted cluster bus packets

Quick assessment

Affected
Red Hat Confidential Compute Attestation
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Redis 社区版中，集群总线的 PING/PONG/MEET 数据包解析器虽然验证了扩展字段的填充和总长度，但并未检查携带字符串的扩展字段是否正确以空字符（null）结尾。这可能导致攻击者构造特定的数据包，在后续以 C 字符串形式消费负载时触发越界读取。该漏洞可能导致信息泄露或远程拒绝服务（DoS）。Redis 商业版（Redis Software / Redis Enterprise）不受此问题影响。

CVSS 7.1 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-92925

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Redis: redis: out-of-bounds read via crafted cluster bus packets
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-carrying extensions for null-termination. This oversight allows a remote attacker to craft a malicious packet, leading to an out-of-bounds read when the packet's payload is processed. Successful exploitation of this vulnerability could result in the disclosure of sensitive information or a remote denial of service (DoS).
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Red Hat Confidential Compute Attestation - cpe:/a:redhat:confidential_compute_attestation:1
Red Hat Logging Subsystem for Red Hat OpenShift - cpe:/a:redhat:logging:6
Red Hat Pen Drive Powered by Red Hat Lightspeed - cpe:/a:redhat:pdrive_lightspeed:1
Red Hat Red Hat 3scale API Management Platform 2 - cpe:/a:redhat:red_hat_3scale_amp:2
Red Hat Red Hat 3scale API Management Platform 2 - cpe:/a:redhat:red_hat_3scale_amp:2
Red Hat Red Hat 3scale API Management Platform 2 - cpe:/a:redhat:red_hat_3scale_amp:2
Red Hat Red Hat AI Inference Server - cpe:/a:redhat:ai_inference_server:3
Red Hat Red Hat AI Inference Server - cpe:/a:redhat:ai_inference_server:3
Red Hat Red Hat AI Inference Server - cpe:/a:redhat:ai_inference_server:3
Red Hat Red Hat Ansible Automation Platform 2 - cpe:/a:redhat:ansible_automation_platform:2
Red Hat Red Hat Ansible Automation Platform 2 - cpe:/a:redhat:ansible_automation_platform:2
Red Hat Red Hat Ansible Automation Platform 2 - cpe:/a:redhat:ansible_automation_platform:2
Red Hat Red Hat Ansible Automation Platform 2 - cpe:/a:redhat:ansible_automation_platform:2
Red Hat Red Hat Ansible Automation Platform 2 - cpe:/a:redhat:ansible_automation_platform:2
Red Hat Red Hat Ansible Automation Platform 2 - cpe:/a:redhat:ansible_automation_platform:2
Red Hat Red Hat Ansible Automation Platform 2 - cpe:/a:redhat:ansible_automation_platform:2
Red Hat Red Hat Ansible Automation Platform 2 - cpe:/a:redhat:ansible_automation_platform:2
Red Hat Red Hat Ansible Automation Platform 2 - cpe:/a:redhat:ansible_automation_platform:2
Red Hat Red Hat Ansible Automation Platform 2 - cpe:/a:redhat:ansible_automation_platform:2
Red Hat Red Hat Ansible Automation Platform 2 - cpe:/a:redhat:ansible_automation_platform:2
Red Hat Red Hat Ansible Automation Platform 2 - cpe:/a:redhat:ansible_automation_platform:2
Red Hat Red Hat Ansible Automation Platform 2 - cpe:/a:redhat:ansible_automation_platform:2
Red Hat Red Hat Ansible Automation Platform 2 - cpe:/a:redhat:ansible_automation_platform:2
Red Hat Red Hat Ansible Automation Platform 2 - cpe:/a:redhat:ansible_automation_platform:2
Red Hat Red Hat Ansible Automation Platform 2 - cpe:/a:redhat:ansible_automation_platform:2
Red Hat Red Hat Connectivity Link 1 - cpe:/a:redhat:connectivity_link:1
Red Hat Red Hat Developer Hub - cpe:/a:redhat:rhdh:1
Red Hat Red Hat Developer Hub - cpe:/a:redhat:rhdh:1
Red Hat Red Hat Developer Hub - cpe:/a:redhat:rhdh:1
Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3 - cpe:/a:redhat:enterprise_linux_ai:3

II. Public POCs for CVE-2026-92925

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-92925

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-92925 (2)

Vendor Advisories for CVE-2026-92925 (1)

Vendor Pages for CVE-2026-92925 (1)

Other References for CVE-2026-92925 (1)

Same Patch Batch · Red Hat · 2026-09-17 · 8 CVEs total

CVE-2026-86320 7.8 HIGH Flatpak-builder: host code execution via `git am` hook execution in patch source extractio
CVE-2026-87742 7.5 HIGH Quarkus-websockets-next: denial of service (oom) in quarkus-websockets-next via unbounded
CVE-2026-76781 5.5 MEDIUM Libxml2: libxml2: null pointer dereference parsing nextcatalog without catalog attribute
CVE-2026-81829 5.3 MEDIUM Smallrye-jwt: quarkus-smallrye-jwt: smallrye-jwt: unauthenticated same-origin ssrf via uns
CVE-2026-92904 4.3 MEDIUM Rubygem-foreman_remote_execution: job output readable without object-level view_job_invoca
CVE-2026-92893 4.3 MEDIUM Rubygem-foreman_ansible: ansible inventory api ignores view_hosts permission filters, expo
CVE-2026-92894 4.3 MEDIUM Rubygem-foreman_ansible: unscoped lookupvalue deletion allows cross-model override value d

IV. Related Vulnerabilities

Same product: Confidential Compute Attestation
Same vendor: Red Hat
Same weakness: CWE-125

V. Comments for CVE-2026-92925

No comments yet

Leave a comment