CVE-2026-72568

Executive Summary

CVE-2026-72568 is an unpatched out-of-bounds (OOB) read vulnerability in the Redis Cluster Bus message parser, affecting all versions through 8.8.1. An unauthenticated attacker on the adjacent network segment can trigger a denial-of-service (DoS) condition or leak sensitive memory contents by sending a malformed PING message to the Redis Cluster Bus port (default 16379). The flaw resides in the getPingExtLength() function, which fails to validate extension length fields against the actual remaining buffer size before performing a read operation. With a CVSS score of 7.1 (High), this vulnerability is particularly dangerous for organizations running Redis in cluster mode for critical infrastructure, as the network-adjacent attack vector lowers the barrier for exploitation while the potential for memory disclosure amplifies the impact beyond simple service disruption.

Technical Analysis

The vulnerability is rooted in the Redis Cluster Bus protocol implementation, specifically within the message parsing routines responsible for handling PING messages. Redis Cluster nodes communicate via a binary protocol over TCP port 16379 (or the configured cluster-port), exchanging gossip messages, configuration epochs, and health checks. The PING message type includes optional extensions (PING_EXT) designed to carry additional metadata such as cluster state information.

The vulnerable function, getPingExtLength(), is invoked during the parsing of incoming cluster bus messages. Its purpose is to extract the length of extension data appended to a PING message. The parser reads a length field from the message header and returns it to the caller for subsequent buffer offset calculations. The flaw: the function does not compare the declared extension length against the actual remaining bytes in the received message buffer.

Consider the parser flow:

1. The cluster bus receives a packet into a fixed-size buffer (clusterMsg).
2. The parser identifies the message type as PING and locates the extension length field.
3. getPingExtLength() reads a 32-bit integer (or similar length field) directly from the packet data via memcpy or pointer dereference.
4. The caller then uses this length to compute the end offset of the extension: p = msg->data.ping.ext + ext_len.
5. If ext_len is attacker-controlled and exceeds the actual buffer capacity (e.g., declared as 0xFFFFFFF0 while the buffer is only 4KB), the subsequent read operation — such as parsing the extension payload or copying the ping body — reads past the heap-allocated buffer boundary.

The out-of-bounds read manifests as either:

• Information disclosure: If the read operation copies extension data into a response or error message, the attacker receives heap memory contents adjacent to the buffer, potentially exposing sensitive data like keys, session tokens, or other nodes' configuration.
• Denial of service: The OOB read can trigger a segmentation fault when the parser dereferences memory beyond the mapped region, crashing the Redis process. In cluster environments, this forces a failover, potentially interrupting service for all connected clients.

The attack surface is limited to adjacent networks (AV:A), meaning the attacker must share a broadcast/collision domain with the target — typically a local network segment, or a virtual network in cloud environments where tenants share the same L2 infrastructure. The vulnerability is reachable without authentication (PR:N) and requires no user interaction (UI:N).

Exploitation Scenarios

Scenario 1: Denial-of-Service via Cluster Bus Flood

An attacker who has gained a foothold on the same network segment as a Redis Cluster (e.g., through a compromised edge device or by exploiting a separate network service) can perform the following:

1. Reconnaissance: Scan the local subnet for port 16379 using a tool like nmap -p 16379 --open 192.168.1.0/24 to identify Redis Cluster nodes.
2. Weaponization: Craft a raw TCP packet with the Redis Cluster Bus protocol header. The message header fields must be set as follows:
   • type = CLUSTERMSG_TYPE_PING (opcode 0)
   • totlen = a value smaller than the actual packet size (to avoid early size rejection)
   • data.ping.ext_len = 0xFFFF (over-allocated length field)
3. Payload Execution: Send the packet using a custom Python script with raw sockets:

   import socket, struct
   sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
   sock.connect(('192.168.1.50', 16379))
   # Minimal cluster bus header (24 bytes) + PING payload
   packet = struct.pack('<QBBH', 0, 0, 0, 0)  # sig, type, flags, totlen
   packet += b'\x00' * 16  # sender node ID
   packet += struct.pack('<I', 0xFFFF)  # ext_len (oversized)
   packet += b'A' * 512  # filler
   sock.send(packet)
   sock.close()
   

   The server parses the oversized ext_len, attempts to read the extension area past the buffer, and crashes with a segfault or abort.
4. Post-Exploitation Impact: The Redis node restarts (or fails over if a replica is available). Repeated attacks cause continuous failover cycles, making the cluster unavailable to application clients. In a single-node deployment, the service is simply down.

Scenario 2: Memory Disclosure to Extract Sensitive Data

For a more targeted attack where the attacker seeks information disclosure:

1. Reconnaissance: Identify a Redis Cluster node that holds encrypted data or authentication tokens in memory (accessible via Redis keys).
2. Weaponization: Modify the DoS packet to maximize the OOB read length, then align the crafted message so that the extension data contains attacker-controlled markers (e.g., \xDE\xAD\xBE\xEF) that will be copied into error messages or cluster gossip responses.
3. Trigger: Send the crafted PING with ext_len slightly larger than the buffer (e.g., buffer 4096 bytes, ext_len=4096+64). The parser reads 64 bytes past the boundary.
4. Data Exfiltration: The Redis node processes the malformed extension and includes the trailing bytes in its next gossip message or logs the incoming message with a debug output. The attacker sniffs the traffic on the adjacent segment with tcpdump -i eth0 -X 'port 16379' to capture the leaked memory contents. Memory adjacent to the cluster bus buffer commonly contains connection metadata, pending commands, or serialized key data.

Both scenarios are feasible with publicly available packet-crafting tools (scapy, hping3) and do not require prior authentication to the Redis instance.

Impact Assessment

The CVSS vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H translates to the following concrete impacts:

• Availability (High): The primary impact is a complete denial of service. A single malformed packet crashes the Redis process. For clusters, this forces failover, which may cause transient write errors and connection resets for clients. An attacker can automate packet transmission to keep nodes in a crash-restart loop, rendering the entire cluster unavailable.
• Confidentiality (Low): The OOB read can leak limited amounts of heap memory. While the exposed data volume is bounded by the packet size delta (typically a few hundred bytes per request), repeated exploitation can leak significant portions of memory over time. This may expose Redis keys, client connection details, or other internal structures that could facilitate further attacks.
• Integrity (None): The vulnerability does not allow direct data modification.

Blast radius: All Redis Cluster deployments using version 8.8.1 or earlier are exposed IF the cluster bus port (16379) is reachable by untrusted hosts on the same subnet. This includes:

• Standard Redis Cluster deployments in data centers
• Managed Kubernetes clusters where Redis operates with cluster mode and network policies are too permissive
• Legacy monolithic applications that enable Redis Cluster for high availability
• Cloud VPCs with flat network topologies or missing security group rules for the cluster port

The "adjacent network" vector is often underestimated; in shared cloud networks or corporate LANs, this effectively means any tenant or compromised host on the same L2 segment can trigger the vulnerability.

Detection Guidance

Sigma Rule

title: Redis Cluster Bus OOB PING Detection
id: b3b5f3c2-8e2a-4a1c-9f6b-4c3d0e5f6a7b
status: experimental
description: Detects malformed Redis Cluster Bus PING messages with oversized extension length fields indicating CVE-2026-72568 exploitation attempts.
logsource:
  category: network_connection
  product: linux
detection:
  selection_redis_port:
    destination.port: 16379
  selection_ping_packet:
    # Placeholder for packet parser output; adjust to your packet capture field names
    packet.payload_hex|endswith: '00000000'  # ext_len field pattern (0xFFFF = FF FF, placeholder)
    packet.payload_length: '< 256'
  condition: selection_redis_port and selection_ping_packet
level: high
tags:
  - attack.t1190
  - cve.2026-72568
  - redis.cluster.oob
falsepositives:
  - Legitimate Redis Cluster PING messages with unusual but valid extensions
  - Packet captures with incomplete payload fields

YARA Rule

rule redis_cve_2026_72568_oob_ping
{
    meta:
        author = "Valters IT Security Team"
        date = "2026-01-01"
        description = "Detects Redis Cluster Bus packets with oversized extension lengths for CVE-2026-72568"
        cve = "CVE-2026-72568"
        severity = "high"
    strings:
        $ping_type = { 00 00 00 00 00 00 00 00 00 }  // First 9 bytes: sig + zeroed type
        $ext_ff = { FF FF 00 00 }                      // ext_len = 0xFFFF (little-endian) or similar large value
        $ext_fe = { FE FF 00 00 }                      // ext_len = 0xFFFE
        $ext_fc = { FC FF 00 00 }                      // ext_len = 0xFFFC (up to 65531)
        $tor_node = { 31 33 39 32 36 39 2E 31 31 39 } // "136.." or other IP literals (optional)
    condition:
        $ping_type at 0 and (any of ($ext_*)) and filesize > 24 and filesize < 1024
}

Suricata IDS Rule

alert tcp any any -> any 16379 (msg:"ET EXPLOIT Redis Cluster Bus PING OOB Extension Length (CVE-2026-72568)"; flow:to_server,established; content:"|00 00 00 00 00 00 00 00|"; depth:8; offset:0; content:"|ff ff 00 00|"; distance:4; within:4; pcre:"/^\x00{8}\x00{2}/"; classtype:attempted-dos; sid:202672568; rev:1; metadata:created_at 2026_01_01, cve CVE-2026-72568;)

Note: The above rule assumes a Redis Cluster Bus header of 24 bytes where the extension length field resides at offset 8. Modify the content match offsets based on exact protocol layout if needed.

Elastic Detection

sequence by source.ip, destination.ip with maxspan=5m
  [ network where destination.port == 16379 and network.protocol == "tcp" and
    event.action == "connection_attempt" ]
  [ network where destination.port == 16379 and network.protocol == "tcp" and
    event.action == "connection_established" ]
  [ process where event.type == "start" and process.name == "redis-server" and
    process.exit_code == 139 ]  // SIGSEGV exit code
| where _id != null

Alternative EQL for memory leak detection through auditd:

sequence by process.pid
  [ file where file.name == "redis-server" and event.action == "segfault" ]
  [ file where file.name == "core" and file.extension == "" ]  // Core dump generation

Splunk SPL Query

index=network sourcetype="cisco:asa" OR sourcetype="fortinet:fortigate" dest_port=16379
| rename src_ip as attacker, dest_ip as victim
| table _time, attacker, victim, bytes_in, bytes_out
| stats count by attacker, victim, bytes_in
| where bytes_in < 1024   // Fragmented or tiny malformed packets
| sort - count

For host-based detection (crash monitoring):

index=unix sourcetype=linux:syslog
| search "Segmentation fault" OR "Fatal: Redis Cluster bus" OR "core dumped"
| where "redis-server" IN (process, program)
| table _time, host, process, message
| rex field=message "(?<pid>\d+)"
| stats count by host, process

Wazuh OSSEC Rule

<group name="redis,cve-2026-72568,">
  <rule id="248230" level="10">
    <if_sid>5715</if_sid>
    <program_name>redis-server</program_name>
    <match>Segmentation fault|AddressSanitizer: heap-buffer-overflow|out-of-bounds read</match>
    <description>CVE-2026-72568: Possible Redis Cluster Bus OOB read caused crash (Redis up to 8.8.1)</description>
    <group>cluster_bus,oob,crash,</group>
  </rule>
  <rule id="248231" level="7">
    <if_sid>5715</if_sid>
    <program_name>redis-server</program_name>
    <match>Could not read cluster bus message|invalid packet length</match>
    <description>CVE-2026-72568: Suspicious malformed cluster bus message received</description>
    <group>cluster_bus,oob,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No vendor fix, advisory, or commit has been identified from any tracked source as of the report date. Redis 8.8.1 is the latest available version and remains vulnerable.

Immediate Mitigations (without a patch):

1. Network Segmentation (Critical): Restrict access to the Redis Cluster Bus port (16379) to only trusted Redis nodes. Implement firewall rules (iptables, AWS Security Groups, NSGs) that allow inbound connections on 16379 ONLY from other cluster node IPs, not from the general subnet. For single-node setups, block port 16379 from all external hosts.
2. Disable Cluster Mode: If cluster mode is not essential, run Redis in standalone mode with cluster-enabled no. This removes the vulnerable code path entirely from active use.
3. Enable Authentication: While the vulnerability itself does not require auth, enabling requirepass for client connections reduces the risk of post-crash data exposure through other means.
4. Deploy IPS Signatures: Push the provided Suricata rule or equivalent Snort signatures to network IPS devices positioned at L2 boundaries to block or alert on malformed cluster bus packets.
5. Monitor for Crashes: Deploy the Elastic/Splunk/Wazuh detection rules to alert on abnormal Redis process termination, allowing rapid response to exploitation attempts.

Patch/Upgrade Steps:

• As of this report, no patched version exists. Continuously monitor Redis GitHub releases (https://github.com/redis/redis/releases) and the official security advisory feed for a version > 8.8.1.
• When a patched version is released, upgrade immediately:

  # For binary installs
  wget https://github.com/redis/redis/archive/refs/tags/vX.Y.Z.tar.gz
  make && make install
  # Then restart all cluster nodes with rolling restart to avoid full downtime
  

• Verify the patch by testing with a crafted PING message in a staging environment first.

Long-Term Hardening:

1. Zero Trust Networking: Apply micro-segmentation so that even adjacent-network hosts cannot reach Redis ports unless explicitly granted.
2. Isolation: Run Redis in dedicated VPCs or VLANs with no untrusted co-tenancy on the same L2 segment.
3. Resource Limits: Deploy Redis with ulimit and container resource constraints to limit the blast radius of heap over-reads (reduces information disclosure value).
4. Memory Protections: Build Redis with ASLR and heap canaries enabled (-fstack-protector-strong) to convert some OOB reads into immediate clean crashes rather than silent leaks.
5. Regular Penetration Testing: Include Redis Cluster Bus fuzzing in your annual security assessment scope.
6. Threat Monitoring: Maintain enhanced logging and SIEM correlation rules for any network traffic to port 16379 from non-cluster hosts.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-72568 — Official NVD record with CVSS vector and description.
2. Redis Official Site: https://redis.io/download — Check for future patched releases and security announcements.
3. Redis GitHub Repository: https://github.com/redis/redis/commits/unstable — Monitor commit history for the getPingExtLength() function fix.
4. CWE-125 Reference: https://cwe.mitre.org/data/definitions/125.html — Technical details on the out-of-bounds read weakness class.
5. ATT&CK T1190: https://attack.mitre.org/techniques/T1190/ — Exploitation of Public-Facing Application technique referencing this attack vector.

Exploit-in-the-Wild Evidence: No active exploitation campaigns or proof-of-concept code has been publicly confirmed as of this writing. However, the vulnerability class (trivial pre-auth OOB read via TCP) is highly attractive to botnet operators and ransomware groups; organizations are advised to treat this as a zero-day with emergent risk until patched.