CVE-2026-92925

Public on 2026-09-17
Modified on 2026-09-18
Description
A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-carrying extensions for null-termination. This oversight allows a remote attacker to craft a malicious packet, leading to an out-of-bounds read when the packet's payload is processed. Successful exploitation of this vulnerability could result in the disclosure of sensitive information or a remote denial of service (DoS).
Severity
Important severity
Important
See what this means
CVSS v3 Base Score
7.1
See breakdown

Affected Packages

Platform Package Release Date Advisory Status
Amazon Linux 2 - Redis6 Extra hiredis Not Affected
Amazon Linux 2023 hiredis Not Affected
Amazon Linux 2027 Preview hiredis Not Affected
Amazon Linux 2 - Lamp-mariadb10.2-php7.2 Extra php-pecl-redis No Fix Planned
Amazon Linux 2 - Php7.2 Extra php-pecl-redis No Fix Planned
Amazon Linux 2 - Php7.3 Extra php-pecl-redis No Fix Planned
Amazon Linux 2 - Php7.4 Extra php-pecl-redis No Fix Planned
Amazon Linux 2023 php8.1-pecl-redis6 Not Affected
Amazon Linux 2023 php8.2-pecl-redis6 Not Affected
Amazon Linux 2023 php8.3-pecl-redis6 Not Affected
Amazon Linux 2023 php8.4-pecl-redis6 Not Affected
Amazon Linux 2023 php8.5-pecl-redis6 Not Affected
Amazon Linux 2027 Preview php8.5-pecl-redis6 Not Affected
Amazon Linux 2 - Redis6 Extra redis Not Affected
Amazon Linux 2 - Redis4.0 Extra redis No Fix Planned
Amazon Linux 2023 redis6 No Fix Planned
Amazon Linux 2 - Redis4.0 Extra rubygem-redis No Fix Planned
Amazon Linux 2023 valkey Pending Fix
Amazon Linux 2027 Preview valkey Pending Fix

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv3 7.1 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H