Skip to content
Fencer Vulns
high 7.1

CVE-2026-92925 json

Redis: redis: out-of-bounds read via crafted cluster bus packets

published 2026-09-17 53 d ago modified 2026-11-05 4 d ago also EUVD-2026-81460

cvss
7.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 55%
public exploits
0
none known

Summary

A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-carrying extensions for null-termination. This oversight allows a remote attacker to craft a malicious packet, leading to an out-of-bounds read when the packet's payload is processed. Successful exploitation of this vulnerability could result in the disclosure of sensitive information or a remote denial of service (DoS).

Patch / fix

  • Red Hat Red Hat Enterprise Linux 10 0:8.0.7-1.el10_1
  • Red Hat Red Hat Enterprise Linux 9 0:8.0.7-1.el9_7, 9080020260821173335.9
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 9040020260917140622.9
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support 9060020260917140656.9
  • redis Debian 12 5:7.0.15-1~deb12u10
  • redis Debian 14 5:8.0.6-3

debian advisories DEBIAN-CVE-2026-92925

  • redis Ubuntu 24.04 LTS 5:7.0.15-1ubuntu0.24.04.5
  • redis Ubuntu 26.04 LTS 5:8.0.5-1ubuntu0.1

ubuntu advisories UBUNTU-CVE-2026-92925

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • redis RHEL 9 7.2.16-1.module+el9.8.0+24745+654dcf03
  • redis RHEL 9.4 E4S 7.0.12-2.module+el9.4.0+24911+6845972a.9
  • redis RHEL 9.6 EUS 7.2.16-1.module+el9.6.0+24910+8b24772d

red hat advisories RHSA-2026:69521RHSA-2026:69520RHSA-2026:65120

  • valkey SLE Module for Server Applications 15 SP7 8.0.12-150700.3.29.1
  • valkey SLE Module for Server Applications 15 SP7 8.0.10-150700.3.26.1
  • valkey SLES for SAP applications 16.0, SLES 16.0 8.0.10-160000.2.1
  • redis7 SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE High Performance Computing 15 SP5-LTSS +1 more 7.0.8-150500.3.40.1
  • valkey SLES for SAP 15 SP6, SLES 15 SP6-LTSS 8.0.12-150600.13.34.1
  • valkey SLES for SAP 15 SP6, SLES 15 SP6-LTSS 8.0.10-150600.13.31.1
  • redis7 SLES for SAP 15 SP6, SLES 15 SP6-LTSS 7.0.8-150600.8.34.1
  • redis SLES for SAP 15 SP6, SLES 15 SP6-LTSS 7.2.4-150600.3.33.1

suse advisories SUSE-SU-2026:5102-1SUSE-SU-2026:5092-1SUSE-SU-2026:4493-1SUSE-SU-2026:4491-1SUSE-SU-2026:23986-1SUSE-SU-2026:4377-1

  • valkey openSUSE Tumbleweed 9.1.2-3.1
  • valkey openSUSE Leap 16.0 8.0.10-160000.2.1

opensuse advisories openSUSE-SU-2026:11951-1openSUSE-SU-2026:21985-1

  • valkey AlmaLinux 9 8.0.7-1.el9_7

almalinux advisories ALSA-2026:3507

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-92925 updated cvss 7.1

redis: Redis: Out-of-bounds read via crafted cluster bus packets

  • Red Hat Pen Drive Powered by Red Hat Lightspeed pen-drive/pen-drive-scanner-rhel9 Red Hat Hardened Images valkey
    affected: workaround, no fix available
  • Red Hat Enterprise Linux AppStream (v. 9) valkey 8.0.7-1.el9_7, redis 7.2.16-1.module+el9.8.0+24745+654dcf03
    fixed: vendor fix RHSA-2026:3507
  • Red Hat Enterprise Linux AppStream (v. 10) valkey 8.0.7-1.el10_1
    fixed: vendor fix RHSA-2026:3443
  • Red Hat Enterprise Linux AppStream E4S (v.9.4) redis 7.0.12-2.module+el9.4.0+24911+6845972a.9
    fixed: vendor fix RHSA-2026:69521
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) redis 7.2.16-1.module+el9.6.0+24910+8b24772d
    fixed: vendor fix RHSA-2026:69520
  • Red Hat 3scale API Management Platform 2 3scale-amp2/system-rhel8, 3scale-amp2/system-rhel9, 3scale-amp2/backend-rhel8
    not affected: vulnerable code not in execute path
  • Red Hat Enterprise Linux 8 redis Red Hat Enterprise Linux 9 redis
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
53 d ago

Exploit prediction

0.75% chance of exploitation in the next 30 days, higher than 55% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.1 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Affected products

  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support
  • Red Hat Pen Drive Powered by Red Hat Lightspeed
  • Red Hat Red Hat 3scale API Management Platform 2
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Hardened Images

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.