Most recent entries from all

EUVD-2026-373840

fkie_cve-2026-92925

A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-carrying extensions for null-termination. This oversight allows a remote attacker to craft a malicious packet, leading to an out-of-bounds read when the packet's payload is processed. Successful exploitation of this vulnerability could result in the disclosure of sensitive information or a remote denial of service (DoS).

GHSA-3gvw-xg56-j2xm

In Redis community the cluster bus PING/PONG/MEET packet parser validated extension padding and total length but never checked that string-carrying extensions are properly null-terminated, allowing a crafted packet to trigger out-of-bounds reads when the payload is later consumed as a C string. This vulnerability can potentially lead to loss of confidentiality or remote denial of service. Redis Software / Redis Enterprise are not affected by this issue.

openSUSE-SU-2026:11951-1 — valkey-9.1.2-3.1 on GA media

valkey-9.1.2-3.1 on GA media

RHSA-2026:69521 — Red Hat Security Advisory: redis:7 security update

redis: Redis: Remote Code Execution via specially crafted RESTORE payload redis: Redis: Arbitrary code execution via TLS pending-data list use-after-free redis: Redis: Out-of-bounds read via crafted cluster bus packets

RLSA-2026:65120 — Important: redis:7 security update

Affected: Rocky Linux:9: redis

Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, or by appending each command to a log.

Security Fix(es):

* redis: Redis: Remote Code Execution via specially crafted RESTORE payload (CVE-2026-66373)

* redis: Redis: Denial of Service via Out-of-Bounds Read in Cluster Bus (CVE-2026-72568)

* redis: Redis: Arbitrary code execution via TLS pending-data list use-after-free (CVE-2026-81934)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

SUSE-SU-2026:4370-1 — Security update for redis

Security update for redis

UBUNTU-CVE-2026-92925

Affected: Ubuntu:24.04:LTS: redis, Ubuntu:26.04:LTS: redis