EUVD-2026-84106Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed OpenCanary Redis module
-
ExploitSend crafted Redis-protocol request
-
ExecutionTrigger unconstrained memory allocation (CWE-770)
-
ImpactExhaust process memory / crash honeypot
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires that the OpenCanary sensor be deployed with its Redis honeypot/emulation module enabled and network-reachable by the attacker (PR:N, UI:N - no authentication or victim interaction). The limiting factors are: impact is availability-only (A:L) affecting the honeypot process, not the underlying host or other services; exploitation depends on the Redis module being turned on (not necessarily every OpenCanary deployment enables it); and the product is a deception sensor typically placed on internal/monitored segments rather than broadly internet-exposed, narrowing real reachability. |
| Impact | This is a genuinely LOW-priority issue and the signals are internally consistent about that. The vendor CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L, base 3.7) describes a remotely reachable, unauthenticated flaw whose ONLY impact is partial availability (A:L) - no confidentiality or integrity loss and no scope change. CWE-770 (unconstrained resource allocation) matches the description of 'unconstrained memory usage,' meaning worst case is memory pressure / possible crash of the honeypot process, not code execution. No EPSS score, no CISA KEV listing, and no POC were supplied, so exploitation is theoretical: 'no public exploit identified at time of analysis.' The one point worth verifying is complexity - the vendor chose AC:H, but memory-exhaustion via an unauthenticated protocol parser is typically low-effort, so I independently assess AC:L (raising base to ~5.3); this is a disagreement on complexity only, not on impact. Even at 5.3 this remains a low/medium availability-only bug. Net: low real-world urgency, driven further down by the niche footprint of the affected product. |
| Exploit ScenarioDerived | An attacker who can reach an exposed OpenCanary sensor's emulated Redis service sends crafted or repeated Redis-protocol input that the Redis module allocates without bound, driving the honeypot process's memory usage up until it is killed or the host degrades. No authentication or user interaction is required, but the impact is limited to availability of the honeypot itself. No public exploit code is known at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 21, 2026
Unconstrained memory consumption in Thinkst Canary's OpenCanary Redis emulation module can be driven by an unauthenticated remote attacker, causing the deception sensor process to exhaust memory and degrade or crash. The issue affects OpenCanary 0.9.9 as reported by Thinkst Applied Research and is availability-only (CWE-770, resource allocation without limits), assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - a low-severity, low-priority finding. No public exploit code exists and there is no indication of active exploitation (not in CISA KEV), and exploitation requires the Redis honeypot module to be enabled and reachable; the impact is confined to the OpenCanary honeypot process rather than the underlying host, making real-world risk limited.
RemediationAI
Patch status is not confirmed from the available data: the only vendor reference is the GitHub security advisory GHSA-77jg-5rmj-77jx (https://github.com/thinkst/opencanary/security/advisories/GHSA-77jg-5rmj-77jx), which should be consulted for the exact fixed release before upgrading - do not assume a specific version number. Because the flaw is confined to the Redis emulation module, the most effective compensating control is to disable that module in the OpenCanary configuration if Redis deception is not required for your deployment, accepting the trade-off that you lose visibility into Redis-targeted attacker activity. If the module is needed, restrict who can reach the sensor port using firewall rules or network segmentation so only expected/monitored segments can connect, which reduces but does not eliminate exposure from an attacker already inside that segment. Additionally, bound the blast radius by running the sensor under a memory cap (for example systemd MemoryMax/MemoryHigh or a container memory limit) so runaway allocation triggers an OOM kill of only the honeypot process rather than destabilizing the host - at the cost of a process restart and loss of any in-memory session state - and enable memory-usage alerting on the sensor to detect abuse early. No vendor-released patch was identified at time of analysis, so verify the advisory for updates before relying on any of these workarounds long term.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OpenCanary is the open-source honeypot/sensor component of Thinkst Canary, a deception platform that emulates services (including Redis) to detect and log attacker interaction. This finding lives in the Redis emulation module, which accepts attacker-supplied Redis protocol traffic and processes it without imposing meaningful bounds on the memory it allocates - the root-cause class captured by CWE-770 (Allocation of Resources Without Limits or Throttling). Because the module is a decoy service reachable over the network, an attacker speaking to it can drive repeated or oversized allocations that the process never releases or caps, producing unconstrained memory usage. The exploitation vector is network-based with no authentication or user interaction (AV:N/PR:N/UI:N per the independent assessment), but the outcome is purely availability: only the honeypot process is degraded, with no confidentiality or integrity impact and no cross-boundary effect on the host (S:U, A:L). The vendor's published CVSS reflects a higher attack-complexity assumption (AC:H), whereas the independent assessment scores AC:L; either way the severity is low and the mitigating factor is that the Redis module must be enabled and reachable for the bug to be triggered.
Know when Redis gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Unauthenticated network-reachable memory exhaustion via the Redis module is low-complexity (AC:L, vs vendor AC:H); only partial availability impact, no confidentiality or integrity.
Primary rating from Vendor (ThinkstAppliedResearch).
CVSS VectorVendor: ThinkstAppliedResearch
Lifecycle Timeline
1DescriptionCVE.org
Denial-of-Service in Redis module in Thinkst Canary's OpenCanary 0.9.9 allows an unauthenticated remote attacker cause unconstrained memory usage.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Privilege escalation to root in the LiteSpeed User-End cPanel Plugin (versions 2.3 through before 2.4.5) lets attackers
UAF in Redis 8.2.1 via crafted Lua scripts by authenticated users. EPSS 12.4%. Patch available.
Authenticated Redis users with permission to run server-side Lua can trigger an integer overflow (CWE-190) in the bundle
It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific
Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10,
Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua bytecode via the eval command.
A buffer overflow in Redis 3.2.x prior to 3.2.4 causes arbitrary code execution when a crafted command is sent. Rated cr
Authenticated Lua script execution in Redis 8.2.1 and earlier can be abused with a crafted long-string delimiter to trig
Authenticated remote code execution in OpenC3 COSMOS (Ruby gem 'openc3' versions 5.1.0 through 7.2.1) lets any logged-in
CVE-2025-46818 is a sandbox-escape flaw in Redis's embedded Lua scripting engine (all versions up to and including 8.2.1
Code injection in OneUptime monitoring via custom JS monitor using vm module. PoC and patch available.
RESP protocol command injection in Predis, the popular PHP client for Redis and Valkey, affects versions 3.0.0-RC1 throu
Exploit-DB