Redis Open Source CVE-2026-92925

Requires the target to be running Redis Open Source in cluster mode (cluster-enabled yes) so the cluster bus PING/PONG/MEET packet parser is active, and the attacker must be able to send packets to the node's cluster bus port (typically data-port + 10000) - i.e. presence on the adjacent internal cluster/interconnect network, not the public internet (AV:A). The cluster bus performs no authentication by default (PR:N, UI:N), so any peer able to reach that port can deliver the malformed packet. The specific trigger is a string-carrying extension (CLUSTERMSG_EXT_TYPE_HOSTNAME, HUMAN_NODENAME, or SHARDID) whose data is not null-terminated. Limiting factors: single-node/non-cluster Redis deployments are not exposed, network segmentation of the cluster bus sharply reduces reachability, and affected versions are 7.0.0 through 8.8.1 (fixed in 8.10.0).

Signals are consistent and point to a moderate, not urgent, priority. The vendor CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H, 7.1) is credible: the flaw lives in the Redis cluster bus PING/PONG/MEET packet parser, which is reachable only over the adjacent cluster-interconnect network (AV:A), needs no authentication (the cluster bus has no auth by default), and yields at worst a partial info-leak (C:L) plus a full node crash (A:H). CISA SSVC reinforces the lower urgency: Exploitation=none (no observed activity), Automatable=no, Technical Impact=partial. No EPSS score, no KEV listing, and no public exploit are present - so this is 'no public exploit identified at time of analysis,' not active exploitation. The main caveat is that the vendor labels this AV:A while some readers may assume network-wide reachability; that is NOT the case - exploitation is confined to hosts that can reach the cluster bus port, which is normally a segmented internal network. Net: a real, patch-worthy memory-safety bug gated behind cluster-mode deployment and adjacent-network access, appropriately mid-tier rather than a drop-everything emergency.

An attacker with a foothold on the internal cluster/interconnect network (a compromised peer node, container, or host in the same segment) crafts a cluster bus PING or MEET packet carrying a string extension (hostname, human node name, or shard-id) whose payload is not null-terminated. When a target Redis node later consumes that field as a C string, it reads out of bounds, either crashing the node (remote DoS) or potentially returning adjacent heap memory. No public exploit code exists, and access is limited to the adjacent cluster network rather than the internet.