CVE-2026-92925

Executive Summary

CVE-2026-92925 is an out-of-bounds read (CWE-125) in the Redis community cluster bus packet parser. The parser validates extension padding and total packet length but fails to verify that string-carrying extensions are null-terminated, so a crafted cluster bus packet can cause memory beyond the intended buffer boundary to be read when the payload is later consumed as a C string. Redis Software and Redis Enterprise are explicitly unaffected; exposure is limited to community-edition instances with cluster mode enabled and a reachable cluster bus port. The stated impact is potential loss of confidentiality (out-of-bounds memory disclosure) or remote denial of service (crash) — no remote code execution is described.

Technical Analysis

Redis Cluster nodes communicate over a dedicated "cluster bus" using a binary protocol on the client port plus 10,000 (default 16379 when the client port is 6379). Nodes exchange PING, PONG, and MEET packets to maintain cluster state, gossip node metadata, and discover new nodes. These packets contain extension fields, and some extensions carry string payloads that are stored in a length-delimited binary field but later consumed by application code as C strings (i.e., via NUL-terminated semantics such as strlen/strcmp-style handling).

The flaw described by the vendor is a missing validation step: the parser checks two things — (1) extension padding and (2) total packet length — but never checks that string-carrying extensions include a terminating NUL byte within their declared bounds. Because the consuming code treats those bytes as a C string, a packet whose string extension is not null-terminated causes the reader to walk past the end of the validated buffer until it encounters a zero byte somewhere in adjacent memory. That is the classic out-of-bounds read pattern mapped to CWE-125.

Two consequences follow directly from the description:

• Confidentiality loss: bytes read past the end of the string extension are pulled from out-of-bounds heap (or adjacent) memory and may be processed, echoed in error handling, propagated into cluster state, or otherwise observable to the attacker. This is a memory-disclosure primitive, not a write primitive.
• Remote denial of service: absent a NUL byte nearby, the read can run off the end of a mapped page and raise a fault, terminating the Redis process. Since cluster bus traffic is peer-to-peer, loss of one node degrades the cluster; depending on configuration this can cascade into loss of quorum, slot migration failures, and service interruption.

Attack surface and prerequisites are governed by two realities. First, the vulnerable parser handles PING/PONG/MEET packets, i.e., cluster-internal traffic; it is not the client request parser. An attacker must therefore deliver a packet that the target's cluster bus accepts and parses. Second, the bus is a separate listener, normally bound to the internal interface and, in hardened deployments, firewalled off. Exploitation therefore requires network reachability to the cluster bus port, or the ability to act as (or impersonate) a cluster peer. Note explicitly: no public proof-of-concept, Nuclei template, or exploit code is associated with this CVE in the provided intelligence, and no affected-version range has been published. The attack chain below is inferred from the vulnerability class and the vendor's own description rather than from observed exploitation.

Exploitation Scenarios

No public PoC exists; the following chain is derived from the vulnerability class (out-of-bounds read in an unvalidated length/termination check) and the vendor description of the parser.

1. Reconnaissance / target identification. The adversary scans for reachable Redis cluster bus listeners. Cluster-enabled nodes expose the bus on the client port + 10,000 (commonly 16379). Fingerprinting is straightforward: the port is open on reachable nodes, and cluster handshake traffic or a benign PING/PONG exchange reveals that the endpoint speaks the Redis cluster bus protocol. Attackers with an existing foothold in the same network segment, VPC, or Kubernetes namespace obtain this reachability without any external exposure.

2. Triggering the flaw class. The attacker crafts a cluster bus packet of the PING/PONG/MEET family whose extension headers pass padding and total-length validation — so the packet is accepted by the parser — but whose string-carrying extension contains a payload with no terminating NUL byte inside its declared bounds. This satisfies every check the parser performs and fails only the check that was never implemented.

3. Payload/execution method. The crafted packet is transmitted to the target's cluster bus listener. When the node later consumes that extension as a C string, the reader continues past the end of the validated buffer into adjacent memory until it hits a zero byte. There is no injection, no code execution, and no write primitive at any point; the operative mechanism is a single unvalidated termination property on a length-delimited string field.

4. Post-exploitation impact. Two outcomes are described by the vendor. (a) Confidentiality: out-of-bounds bytes may be incorporated into application-visible state or mishandled output, leaking adjacent memory contents to the attacker. (b) Denial of service: if no NUL is encountered, the over-read crosses a page boundary and the process faults, terminating the node. In a cluster this can be repeated across peers, degrading availability and potentially triggering failover storms, slot migration churn, and client-visible errors while healthy nodes absorb the load.

Because the mechanism is a read, there is no lateral movement, persistence, or privilege escalation inherent to this CVE. Impact is bounded by what adjacent memory happens to contain and by how disruptive repeated node crashes are to the cluster's availability guarantees.

Impact Assessment

The provider states the impact as potential loss of confidentiality or remote denial of service. Mapped to CVSS v3.1 semantics: network attack vector (AV:N) with high attack complexity (AC:H) — the attacker must craft structurally valid cluster packets and reach the bus — no privileges (PR:N) and no user interaction (UI:N). Scope is unchanged (S:U): the vulnerable component is the cluster bus parser and the impact stays within the Redis node. Integrity is not affected (I:N) because this is a read primitive; confidentiality is low-to-partial (C:L) because leakage is incidental and depends on adjacent memory contents; availability is high (A:H) because an unhandled over-read can crash the node and, in cluster mode, degrade the whole cluster. The CVSS vector above reflects those subscores; no official score was published with this CVE.

Blast radius: only community-edition Redis running with cluster mode enabled and an exposed or reachable cluster bus. Redis Software and Redis Enterprise are explicitly not affected, which materially narrows commercial exposure but does not reduce risk for self-managed community clusters — a very common deployment in caching tiers, session stores, rate limiters, and queue backends. Cascading failure is the primary business concern: a crash-looping cluster node affects every application that depends on that cache or datastore, and cache-tier failure frequently propagates to backend databases as load spikes. Confidentiality loss, while described as low, is meaningful in multi-tenant clusters where adjacent memory in the same process may hold other tenants' keys, ACL material, or session data. CISA KEV listing: NO. EPSS: not yet scored by FIRST.org; do not assume a low likelihood simply because the score is absent — network reachability, not exploitation telemetry, is the gating factor here.

Detection Guidance

General approach: because the trigger is a malformed-but-validating cluster bus packet, detection combines (a) network rules that flag anomalous cluster bus packets to/from non-peer addresses, (b) host rules that correlate Redis process termination with cluster bus activity, and (c) process/audit telemetry for unexpected connections to port 16379. All rules below are defensive heuristics derived from the vulnerability class; none are validated against public PoC traffic.

Sigma Rule

title: Redis Cluster Bus Connectivity from Unexpected Source (CVE-2026-92925 Recon)
id: 3f9c1a72-9b41-4a0e-8a5d-2e6b7c0d1a44
status: experimental
description: Detects network connections to the Redis cluster bus port from hosts outside the known cluster peer set, consistent with reconnaissance or delivery of crafted PING/PONG/MEET packets.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-92925
author: valtersit.com
date: 2026/01/01
logsource:
  category: network_connection
  product: linux
detection:
  selection_port:
    DestinationPort: 16379
  filter_known_peers:
    SourceIp:
      - '10.0.0.0/8'
      - '127.0.0.1'
  condition: selection_port and not filter_known_peers
falsepositives:
  - Legitimate cluster membership changes during scaling events
  - Misconfigured peer lists after subnet migration
level: medium
tags:
  - attack.t1190
  - cve.2026.92925

YARA Rule

rule CVE_2026_92925_Redis_Cluster_Bus_Packet
{
    meta:
        author = "valtersit.com"
        description = "Heuristic hunt for captured Redis cluster bus PING/PONG/MEET packet captures exhibiting string extensions without terminating null bytes. Requires tuning; offsets/lengths define the extension body."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-92925"
        date = "2026-01-01"
        severity = "medium"
    strings:
        $meet = "MEET"
        $ping = "PING"
        $pong = "PONG"
    condition:
        filesize < 512KB and
        (uint8(0) == 0x52 or uint8(0) == 0x4D or $meet or $ping or $pong) and
        not (for any i in (0 .. filesize - 1) : (uint8(i) == 0x00)) and
        filesize > 32
}

Suricata IDS Rule

alert tcp any any -> $HOME_NET 16379 (msg:"CVE-2026-92925 Redis cluster bus packet from non-peer source - possible crafted PING/PONG/MEET"; flow:to_server,established; dsize:>32; threshold:type limit,track by_src,count 5,seconds 60; classtype:attempted-dos; sid:202692925; rev:1;)

Elastic Detection

network where destination.port == 16379 and
  not cidrmatch(source.ip, "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.0/8")

Correlate with a follow-on process event: Redis (or its container) exiting with a signal, which indicates the over-read faulted. See the process rule below.

sequence by host.id with maxspan=10s
  [ network where destination.port == 16379 ]
  [ process where process.name == "redis-server" and event.type == "end" and process.exit_code != 0 ]

Splunk SPL Query

index=network (dest_port=16379 OR dest_port=6379)
| where NOT cidrmatch(src_ip, "10.0.0.0/8") AND NOT cidrmatch(src_ip, "172.16.0.0/12") AND NOT cidrmatch(src_ip, "192.168.0.0/16")
| stats count values(src_ip) as sources values(dest_ip) as targets by dest_port
| where count > 5

Companion query to correlate Redis node crashes with cluster bus reachability:

index=os sourcetype=linux_secure OR index=syslog (process=redis* OR service=redis)
| search ("segmentation fault" OR "signal" OR "crashed" OR "OOM" OR "terminated")
| stats count by host, process
| where count > 1

Wazuh OSSEC Rule

<group name="redis,cve-2026-92925,">
  <rule id="100925" level="8">
    <decoded_as>json</decoded_as>
    <field name="destination.port">16379</field>
    <field name="source.ip" negate="yes">^10\.</field>
    <description>CVE-2026-92925: Redis cluster bus connection from unexpected external source $(source.ip) to port 16379.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>redis_cluster_bus,</group>
  </rule>

  <rule id="100926" level="12">
    <if_sid>100925</if_sid>
    <field name="event.action">drop|reject</field>
    <description>CVE-2026-92925: Redis cluster bus packet from $(source.ip) rejected - suspected crafted PING/PONG/MEET payload.</description>
    <group>redis_cluster_bus,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix version, affected-version range, or official workaround has been published in the provided intelligence. Redis Software / Redis Enterprise are not affected. Until a community-edition fix is available, defense rests on eliminating reachability and reducing crash impact.

1. Immediate mitigations

• Network-isolate the cluster bus. Ensure port 16379/tcp (client port + 10000) is reachable only from known cluster peers. Apply security-group, VPC, firewall, or Kubernetes NetworkPolicy rules with an explicit peer allowlist; default-deny everything else. This is the single most effective control, since the flaw cannot trigger without a delivered packet.
• Remove external exposure. Confirm the bus is not reachable from the internet, untrusted VLANs, or cross-tenant namespaces. Audit for bind directives and container/host port mappings that widen the bus surface.
• Restrict cluster-announce-ip/cluster-announce-port exposure and confirm cluster mode is enabled only where genuinely required. If cluster mode is not needed, disable it to remove the parser from the attack surface entirely.
• Deploy compensating detection (rules above) and alert on any non-peer connection to the bus.
• Consider enabling OS-level service supervision/auto-restart so that a crash from an over-read does not become a prolonged outage, and monitor restart frequency as a signal of active attack.

2. Patch/upgrade steps

• Monitor the Redis community security advisories and releases for a fix; no fix is confirmed at time of writing. Treat any future advisory as authoritative over this report.
• When a fix is published, upgrade all cluster nodes in a rolling fashion following the project's documented cluster upgrade procedure; never leave older nodes as reachable peers during the window.
• If no community fix ships, treat the bus isolation control as permanent, not temporary.

3. Long-term hardening

• Enforce mutual authentication and transport encryption on the cluster bus (tls-cluster yes with tls-auth-clients yes) so only authenticated peers can exchange cluster packets.
• Enable ACLs and, where supported, require authentication for cluster operations; rotate credentials regularly.
• Segment Redis clusters into dedicated subnets with default-deny egress/ingress and strict peer allowlists; keep caches off shared flat networks.
• Add Redis process crash/restart anomalies to the SOC's baseline alerting, and periodically re-test bus reachability with an internal scan.
• Track CVE-2026-92925 in your vulnerability management system and re-audit when a patch version is published; ingest vendor advisories for the community edition specifically.

References

• NVD — CVE-2026-92925: https://nvd.nist.gov/vuln/detail/CVE-2026-92925
• MITRE CWE-125 (Out-of-bounds Read): https://cwe.mitre.org/data/definitions/125.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Redis community security advisories / release notes (monitor for the fix version): https://github.com/redis/redis/security/advisories
• CISA Known Exploited Vulnerabilities catalog (check status; not listed at time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor campaigns / exploit-in-the-wild evidence: none reported. CISA KEV: NO. No public PoC, Nuclei template, or exploit code was identified in the provided intelligence. Note the operator caveat that cluster bus ports are frequently left reachable inside flat cloud networks; even without a public exploit, the reconnaissance logic here is trivial and the primitive requires only a crafted packet, so timely network isolation is warranted.