A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-carrying extensions for null-termination. This oversight allows a remote attacker to craft a malicious packet, leading to an out-of-bounds read when the packet's payload is processed. Successful exploitation of this vulnerability could result in the disclosure of sensitive information or a remote denial of service (DoS).

In Redis community the cluster bus PING/PONG/MEET packet parser validated extension padding and total length but never checked that string-carrying extensions are properly null-terminated, allowing a crafted packet to trigger out-of-bounds reads when the payload is later consumed as a C string. This vulnerability can potentially lead to loss of confidentiality or remote denial of service. Redis Software / Redis Enterprise are not affected by this issue.

valkey-9.1.2-3.1 on GA media

redis: Redis: Remote Code Execution via specially crafted RESTORE payload redis: Redis: Arbitrary code execution via TLS pending-data list use-after-free redis: Redis: Out-of-bounds read via crafted cluster bus packets

Affected: Rocky Linux:9: redis

Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, or by appending each command to a log.

Security Fix(es):

* redis: Redis: Remote Code Execution via specially crafted RESTORE payload (CVE-2026-66373)

* redis: Redis: Denial of Service via Out-of-Bounds Read in Cluster Bus (CVE-2026-72568)

* redis: Redis: Arbitrary code execution via TLS pending-data list use-after-free (CVE-2026-81934)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Security update for redis

Affected: Ubuntu:24.04:LTS: redis, Ubuntu:26.04:LTS: redis

A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-carrying extensions for null-termination. This oversight allows a remote attacker to craft a malicious packet, leading to an out-of-bounds read when the packet's payload is processed. Successful exploitation of this vulnerability could result in the disclosure of sensitive information or a remote denial of service (DoS).