high CVSS 7.5 EPSS 0.71%

CVE-2026-92925·Redis vulnerability

A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-carrying extensions for null-termination. This oversight allows a remote attacker to craft a malicious packet, leading to an out-of-bounds read when the packet's payload is processed. Successful exploitation of this vulnerability could result in the disclosure of sensitive information or a remote denial of service (DoS).

Severity
high
Software
Redis
Fixed in
5:7.0.15-1~deb12u10
Published

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.71% — higher than 53% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Read the two together. CVE-2026-92925 scores 7.5 on CVSS, so a successful attack would be serious — but at 0.71%, almost nobody is currently attempting it. That is a different situation from a flaw under mass exploitation, and it is usually the difference between patching on your next maintenance window and patching tonight.

Affected versions

Until: 5:7.0.15-1~deb12u10

Fixed in: 5:7.0.15-1~deb12u10

How to fix this CVE

Update Redis immediately to version 5:7.0.15-1~deb12u10 or later to patch the cluster bus packet validation flaw. This vulnerability affects the internal cluster communication protocol and can be exploited by attackers with network access to the Redis cluster bus port. Apply the update during a maintenance window and verify cluster connectivity after the patch is deployed.

sudo dnf update redis -y

Defensia detects this vulnerability

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

^.*\[\d+\].*cluster.*error|^.*\[\d+\].*invalid.*extension|^.*\[\d+\].*out of bounds|^.*\[\d+\].*null.*termination|cluster.*malformed.*packet

How to check if you are affected

  1. Check installed Redis version: redis-server --version or redis-cli INFO server | grep redis_version
  2. Verify cluster mode is enabled: redis-cli cluster info | grep cluster_state (if output shows 'ok' or 'fail', cluster is active)
  3. Review Redis logs for malformed cluster packets: grep -i 'cluster.*error\|parsing.*error\|cluster.*invalid' /var/log/redis/redis-server.log
  4. Confirm patch installation: dpkg -l | grep redis or rpm -qa | grep redis, then verify version matches 5:7.0.15-1~deb12u10 or later

FAQ

What is CVE-2026-92925?

This vulnerability exists in Redis's cluster bus packet parser, which improperly validates string-carrying packet extensions. An attacker can send a specially crafted PING, PONG, or MEET packet lacking proper null-termination to trigger an out-of-bounds memory read, potentially leaking sensitive data or causing a denial of service.

Is CVE-2026-92925 being actively exploited?

No, this CVE is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog and no public exploits are currently available. However, the high CVSS score (7.5) and network-accessible attack surface warrant immediate patching.

What versions of Redis are affected by CVE-2026-92925?

All Redis versions up to and including 5:7.0.15-1~deb12u9 are affected. The vulnerability is resolved in version 5:7.0.15-1~deb12u10 and later releases.

How do I check if my server is vulnerable to CVE-2026-92925?

Run: redis-cli INFO server | grep redis_version, then compare the output against version 5:7.0.15-1~deb12u10. If your version is lower, your instance is vulnerable.

Does Defensia detect CVE-2026-92925?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If Redis is installed on a monitored server, CVE-2026-92925 will appear in your dashboard with remediation steps.

Related Redis CVEs

CVE-2022-0543CVSS 10It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.
CVE-2026-23479CVSS 8.8Redis is an in-memory data structure store. In redis-server from 7.2.0 until 8.6.3, the unblock client flow does not handle an error return from `processCommandAndResetClient` when re-executing a blocked command. If a blocked client is evicted during this flow, an authenticated attacker can trigger a use-after-free that may lead to remote code execution. This has been patched in version 8.6.3.
CVE-2026-25243CVSS 8.8Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This is patched in version 8.6.3.
CVE-2018-12326CVSS 8.5Buffer overflow in redis-cli of Redis before 4.0.10 and 5.x before 5.0 RC3 allows an attacker to achieve code execution and escalate to higher privileges via a crafted command line. NOTE: It is unclear whether there are any common situations in which redis-cli is used with, for example, a -h (aka hostname) argument from an untrusted source.
CVE-2026-66373CVSS 8.5Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer, because deleting both consumers via XGROUP DELCONSUMER leads to a double free. NOTE: this issue exists because of an incomplete fix for CVE-2026-25243.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-92925. Free for 1 server.

Get started free