Every CVE Search/ Get API key

CVE-2026-72568

An out-of-bounds read vulnerability in Redis through 8.8.1 allows an adjacent unauthenticated...

7.1 HighRejected

Red Hat CNA-LR concluded that this CVE is not valid.

Attack profile

How easy it is to exploit

Attack vector
Adjacent network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
High

What each source reports

GitHub Advisories Score usedGHSA-qhgh-7273-8939 7.1

An out-of-bounds read vulnerability in Redis through 8.8.1 allows an adjacent unauthenticated...

An out-of-bounds read vulnerability in Redis through 8.8.1 allows an adjacent unauthenticated attacker to cause denial of service or information disclosure by sending a specially crafted PING message to the Redis Cluster Bus port.

Record
GHSA-qhgh-7273-8939
CVSS 3.1
7.1 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Weakness
CWE-125
Updated
2026-11-02
CVE List No score

Red Hat CNA-LR concluded that this CVE is not valid.

Record
CVE-2026-72568
Updated
2026-11-02
EUVDEUVD-2026-55238 7.1

Red Hat CNA-LR concluded that this CVE is not valid.

Record
EUVD-2026-55238
CVSS 3.1
7.1 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Updated
2026-11-02
NVD No score

Rejected reason: Red Hat CNA-LR concluded that this CVE is not valid.

Record
CVE-2026-72568
Updated
2026-11-02
OSV 7.1

Redis - Heap Out-of-Bounds Read in Cluster Bus PING Message Handler

An out-of-bounds read vulnerability in Redis through 8.8.1 allows an adjacent unauthenticated attacker to cause denial of service or information disclosure by sending a specially crafted PING message to the Redis Cluster Bus port.

Record
CVE-2026-72568
CVSS 3.1
7.1 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Weakness
CWE-125
Updated
2026-11-02
OSVDEBIAN-CVE-2026-72568 7.1

An out-of-bounds read vulnerability in Redis through 8.8.1 allows an adjacent unauthenticated attacker to cause denial of service or information disclosure by sending a specially crafted PING message to the Redis Cluster Bus port.

Record
DEBIAN-CVE-2026-72568
CVSS 3.1
7.1 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Updated
2026-11-02
Show 6 moreShow less
OSVRHSA-2026:43236 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:43236
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:65120 7.5

Red Hat Security Advisory: redis:7 security update

Record
RHSA-2026:65120
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:69520 7.5

Red Hat Security Advisory: redis:7 security update

Record
RHSA-2026:69520
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:69521 7.5

Red Hat Security Advisory: redis:7 security update

Record
RHSA-2026:69521
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:65120 7.5

Important: redis:7 security update

Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, or by appending each command to a log.

Security Fix(es):

  • redis: Redis: Remote Code Execution via specially crafted RESTORE payload (CVE-2026-66373)

  • redis: Redis: Denial of Service via Out-of-Bounds Read in Cluster Bus (CVE-2026-72568)

  • redis: Redis: Arbitrary code execution via TLS pending-data list use-after-free (CVE-2026-81934)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:65120
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-72568 7.1

An out-of-bounds read vulnerability in Redis through 8.8.1 allows an adjacent unauthenticated attacker to cause denial of service or information disclosure by sending a specially crafted PING message to the Redis Cluster Bus port.

Record
UBUNTU-CVE-2026-72568
CVSS 3.1
7.1 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Updated
2026-11-02

Affected packages

Affected packages
PackageAffectedFixed
valkey
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:9.0.5-0.1.hum1
0:9.0.5-0.1.hum1
valkey-compat-redis
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:9.0.5-0.1.hum1
0:9.0.5-0.1.hum1
valkey-compat-redis-devel
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:9.0.5-0.1.hum1
0:9.0.5-0.1.hum1
valkey-devel
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:9.0.5-0.1.hum1
0:9.0.5-0.1.hum1
valkey-doc
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:9.0.5-0.1.hum1
0:9.0.5-0.1.hum1
valkey-rdma
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:9.0.5-0.1.hum1
0:9.0.5-0.1.hum1
redis
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 0:7.2.16-1.module+el9.8.0+24745+654dcf03
0:7.2.16-1.module+el9.8.0+24745+654dcf03
redis-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 0:7.2.16-1.module+el9.8.0+24745+654dcf03
0:7.2.16-1.module+el9.8.0+24745+654dcf03
redis-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 0:7.2.16-1.module+el9.8.0+24745+654dcf03
0:7.2.16-1.module+el9.8.0+24745+654dcf03
redis-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 0:7.2.16-1.module+el9.8.0+24745+654dcf03
0:7.2.16-1.module+el9.8.0+24745+654dcf03
Show 12 moreShow less
Affected packages
PackageAffectedFixed
redis-doc
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 0:7.2.16-1.module+el9.8.0+24745+654dcf03
0:7.2.16-1.module+el9.8.0+24745+654dcf03
redis
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 4 CVEs
 before 0:7.2.16-1.module+el9.6.0+24910+8b24772d
0:7.2.16-1.module+el9.6.0+24910+8b24772d
redis-debuginfo
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 4 CVEs
 before 0:7.2.16-1.module+el9.6.0+24910+8b24772d
0:7.2.16-1.module+el9.6.0+24910+8b24772d
redis-debugsource
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 4 CVEs
 before 0:7.2.16-1.module+el9.6.0+24910+8b24772d
0:7.2.16-1.module+el9.6.0+24910+8b24772d
redis-devel
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 4 CVEs
 before 0:7.2.16-1.module+el9.6.0+24910+8b24772d
0:7.2.16-1.module+el9.6.0+24910+8b24772d
redis-doc
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 4 CVEs
 before 0:7.2.16-1.module+el9.6.0+24910+8b24772d
0:7.2.16-1.module+el9.6.0+24910+8b24772d
redis
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 4 CVEs
 before 0:7.0.12-2.module+el9.4.0+24911+6845972a.9
0:7.0.12-2.module+el9.4.0+24911+6845972a.9
redis-debuginfo
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 4 CVEs
 before 0:7.0.12-2.module+el9.4.0+24911+6845972a.9
0:7.0.12-2.module+el9.4.0+24911+6845972a.9
redis-debugsource
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 4 CVEs
 before 0:7.0.12-2.module+el9.4.0+24911+6845972a.9
0:7.0.12-2.module+el9.4.0+24911+6845972a.9
redis-devel
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 4 CVEs
 before 0:7.0.12-2.module+el9.4.0+24911+6845972a.9
0:7.0.12-2.module+el9.4.0+24911+6845972a.9
redis-doc
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 4 CVEs
 before 0:7.0.12-2.module+el9.4.0+24911+6845972a.9
0:7.0.12-2.module+el9.4.0+24911+6845972a.9
redis
Rocky Linux:9
From an advisory covering 3 CVEs
 before 0:7.2.16-1.module+el9.8.0+40315+e15874a8
0:7.2.16-1.module+el9.8.0+40315+e15874a8

History

History
RecordedChangedSources
affected, facts
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-72568 has been rejected by its source and should not be treated as a live vulnerability, published August 7, 2026.

References

Show 42 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open