A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-carrying extensions for null-termination. This oversight allows a remote attacker to craft a malicious packet, leading to an out-of-bounds read when the packet's payload is processed. Successful exploitation of this vulnerability could result in the disclosure of sensitive information or a remote denial of service (DoS).

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation none

Automatable no

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Red Hat Pen Drive Powered by Red Hat Lightspeed affected —
Red Hat Red Hat 3scale API Management Platform 2 affected —
Red Hat Red Hat 3scale API Management Platform 2 affected —
Red Hat Red Hat 3scale API Management Platform 2 affected —
Red Hat Red Hat Enterprise Linux 10 unaffected —
Red Hat Red Hat Enterprise Linux 8 unaffected —
Red Hat Red Hat Enterprise Linux 9 unaffected —
Red Hat Red Hat Enterprise Linux 9 affected —
Red Hat Red Hat Enterprise Linux 9 unaffected —
Red Hat Red Hat Hardened Images affected —

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Project Subscriptions

Vendors Products
Redhat Subscribe
Enterprise Linux Subscribe
Hummingbird Subscribe
Pdrive Lightspeed Subscribe
Red Hat 3scale Amp Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

References
Link Providers
https://access.redhat.com/security/cve/CVE-2026-92925 cve-icon cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=2535971 cve-icon cve-icon
https://github.com/redis/redis/commit/37894faeea11e2db28b9fc2af378a762d2c36523 cve-icon cve-icon cve-icon
https://github.com/redis/redis/pull/15263 cve-icon cve-icon cve-icon
https://github.com/redis/redis/releases/tag/8.10.0 cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-92925 cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-92925 cve-icon
History

Fri, 18 Sep 2026 01:45:00 +0000

Type Values Removed Values Added
First Time appeared Redhat enterprise Linux
Redhat hummingbird
CPEs cpe:/a:redhat:hummingbird:1
cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat enterprise Linux
Redhat hummingbird

Fri, 18 Sep 2026 01:15:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:openstack:18.0
cpe:/a:redhat:rhui:5::el9
Vendors & Products Redhat openstack
Redhat rhui

Fri, 18 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important

Fri, 18 Sep 2026 00:00:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:ai_inference_server:3
cpe:/a:redhat:ansible_automation_platform:2
cpe:/a:redhat:confidential_compute_attestation:1
cpe:/a:redhat:connectivity_link:1
cpe:/a:redhat:enterprise_linux_ai:3
cpe:/a:redhat:logging:6
cpe:/a:redhat:openshift:4
cpe:/a:redhat:openshift_ai
cpe:/a:redhat:openshift_update_service:5
cpe:/a:redhat:openstack:16.2
cpe:/a:redhat:openstack:17.1
cpe:/a:redhat:quay:3
cpe:/a:redhat:rhdh:1
cpe:/a:redhat:satellite:6
Vendors & Products Redhat ai Inference Server
Redhat ansible Automation Platform
Redhat confidential Compute Attestation
Redhat connectivity Link
Redhat enterprise Linux Ai
Redhat logging
Redhat openshift
Redhat openshift Ai
Redhat openshift Update Service
Redhat quay
Redhat rhdh
Redhat satellite

Thu, 17 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics cvssV4_0

{'score': 6.0, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X'}

Thu, 17 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Description In Redis community the cluster bus PING/PONG/MEET packet parser validated extension padding and total length but never checked that string-carrying extensions are properly null-terminated, allowing a crafted packet to trigger out-of-bounds reads when the payload is later consumed as a C string. This vulnerability can potentially lead to loss of confidentiality or remote denial of service. Redis Software / Redis Enterprise are not affected by this issue. A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-carrying extensions for null-termination. This oversight allows a remote attacker to craft a malicious packet, leading to an out-of-bounds read when the packet's payload is processed. Successful exploitation of this vulnerability could result in the disclosure of sensitive information or a remote denial of service (DoS).
Title Out-of-Bounds Read in Cluster Bus Redis: redis: out-of-bounds read via crafted cluster bus packets
First Time appeared Redhat
Redhat ai Inference Server
Redhat ansible Automation Platform
Redhat confidential Compute Attestation
Redhat connectivity Link
Redhat enterprise Linux Ai
Redhat logging
Redhat openshift
Redhat openshift Ai
Redhat openshift Update Service
Redhat openstack
Redhat pdrive Lightspeed
Redhat quay
Redhat red Hat 3scale Amp
Redhat rhdh
Redhat rhui
Redhat satellite
CPEs cpe:/a:redhat:ai_inference_server:3
cpe:/a:redhat:ansible_automation_platform:2
cpe:/a:redhat:confidential_compute_attestation:1
cpe:/a:redhat:connectivity_link:1
cpe:/a:redhat:enterprise_linux_ai:3
cpe:/a:redhat:logging:6
cpe:/a:redhat:openshift:4
cpe:/a:redhat:openshift_ai
cpe:/a:redhat:openshift_update_service:5
cpe:/a:redhat:openstack:16.2
cpe:/a:redhat:openstack:17.1
cpe:/a:redhat:openstack:18.0
cpe:/a:redhat:pdrive_lightspeed:1
cpe:/a:redhat:quay:3
cpe:/a:redhat:red_hat_3scale_amp:2
cpe:/a:redhat:rhdh:1
cpe:/a:redhat:rhui:5::el9
cpe:/a:redhat:satellite:6
Vendors & Products Redhat
Redhat ai Inference Server
Redhat ansible Automation Platform
Redhat confidential Compute Attestation
Redhat connectivity Link
Redhat enterprise Linux Ai
Redhat logging
Redhat openshift
Redhat openshift Ai
Redhat openshift Update Service
Redhat openstack
Redhat pdrive Lightspeed
Redhat quay
Redhat red Hat 3scale Amp
Redhat rhdh
Redhat rhui
Redhat satellite
References
Metrics cvssV4_0

{'score': 6, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N'}

 cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H'}

cvssV4_0

{'score': 6.0, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X'}

Thu, 17 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 17 Sep 2026 12:00:00 +0000

Type Values Removed Values Added
Description In Redis community the cluster bus PING/PONG/MEET packet parser validated extension padding and total length but never checked that string-carrying extensions are properly null-terminated, allowing a crafted packet to trigger out-of-bounds reads when the payload is later consumed as a C string. This vulnerability can potentially lead to loss of confidentiality or remote denial of service. Redis Software / Redis Enterprise are not affected by this issue.
Title Out-of-Bounds Read in Cluster Bus
Weaknesses CWE-125
References
Metrics cvssV4_0

{'score': 6, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-09-18T01:42:04.605Z

Reserved: 2026-09-17T11:31:08.832Z

Link: CVE-2026-92925

cve-icon Vulnrichment

Updated: 2026-09-17T14:24:06.846Z

cve-icon NVD

Status : Received

Published: 2026-09-17T12:18:31.063

Modified: 2026-09-18T02:17:08.280

Link: CVE-2026-92925

cve-icon Redhat

Severity : Important

Publid Date: 2026-09-17T11:48:04Z

Links: CVE-2026-92925 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-17T22:00:16Z

Weaknesses