Redis Open Source
Monthly
Out-of-bounds reads in the Redis Open Source cluster bus packet parser (versions 7.0.0 through 8.8.1) allow an adjacent-network attacker to crash a cluster node or leak small amounts of process memory by sending a crafted PING/PONG/MEET message containing a string-carrying extension that lacks a null terminator. The cluster bus is unauthenticated by default (CVSS PR:N, AV:A), so any peer that can reach a node's cluster bus port can deliver the malformed packet; the behavior is rated CVSS 7.1 with high availability impact and low confidentiality impact. Vendor-released patch: the fix is included in Redis 8.10.0, and no public exploit code has been identified at time of analysis; non-cluster single-node deployments and Redis Software / Redis Enterprise are not affected.
Out-of-bounds reads in the Redis Open Source cluster bus packet parser (versions 7.0.0 through 8.8.1) allow an adjacent-network attacker to crash a cluster node or leak small amounts of process memory by sending a crafted PING/PONG/MEET message containing a string-carrying extension that lacks a null terminator. The cluster bus is unauthenticated by default (CVSS PR:N, AV:A), so any peer that can reach a node's cluster bus port can deliver the malformed packet; the behavior is rated CVSS 7.1 with high availability impact and low confidentiality impact. Vendor-released patch: the fix is included in Redis 8.10.0, and no public exploit code has been identified at time of analysis; non-cluster single-node deployments and Redis Software / Redis Enterprise are not affected.