{"id":"CVE-2026-92925","aliases":["ALSA-2026:3507","DEBIAN-CVE-2026-92925","EUVD-2026-81460","GHSA-3gvw-xg56-j2xm","OESA-2026-4400","OESA-2026-4401","OESA-2026-4402","OESA-2026-4403","RHSA-2026:65120","RHSA-2026:69520","RHSA-2026:69521","SUSE-SU-2026:23986-1","SUSE-SU-2026:4370-1","SUSE-SU-2026:4375-1","SUSE-SU-2026:4377-1","SUSE-SU-2026:4491-1","SUSE-SU-2026:4493-1","SUSE-SU-2026:5092-1","SUSE-SU-2026:5102-1","UBUNTU-CVE-2026-92925","USN-8866-1","openSUSE-SU-2026:11951-1","openSUSE-SU-2026:21985-1"],"status":"published","title":"Redis: redis: out-of-bounds read via crafted cluster bus packets","description":"A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-carrying extensions for null-termination. This oversight allows a remote attacker to craft a malicious packet, leading to an out-of-bounds read when the packet's payload is processed. Successful exploitation of this vulnerability could result in the disclosure of sensitive information or a remote denial of service (DoS).","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00749,"percentile":0.55381,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2026-03-02T00:00:00Z","modified":"2026-11-06T01:07:23Z","fixes":[{"ecosystem":"Debian:12","package":"redis","fixed_in":["5:7.0.15-1~deb12u10"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"redis","fixed_in":["5:8.0.6-3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"valkey","fixed_in":["8.0.10-160000.2.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"valkey","fixed_in":["8.0.10-160000.2.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"redis","fixed_in":["7.2.4-150600.3.33.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"redis","fixed_in":["7.2.4-150600.3.33.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"redis7","fixed_in":["7.0.8-150500.3.40.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"redis7","fixed_in":["7.0.8-150500.3.40.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"redis7","fixed_in":["7.0.8-150500.3.40.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"redis7","fixed_in":["7.0.8-150500.3.40.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"redis7","fixed_in":["7.0.8-150600.8.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"redis7","fixed_in":["7.0.8-150600.8.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"valkey","fixed_in":["8.0.10-150600.13.31.1","8.0.12-150600.13.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"valkey","fixed_in":["8.0.10-150600.13.31.1","8.0.12-150600.13.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"valkey","fixed_in":["8.0.10-150700.3.26.1","8.0.12-150700.3.29.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"redis","fixed_in":["5:7.0.15-1ubuntu0.24.04.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"redis","fixed_in":["5:8.0.5-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"valkey","fixed_in":["9.1.2-3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"valkey","fixed_in":["8.0.10-160000.2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"valkey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.7-1.el9_7"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"valkey-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.7-1.el9_7"}]}],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:7.0.15-1~deb12u10"}]}],"versions":["5:7.0.11-1","5:7.0.11-1+deb12u1","5:7.0.12-1","5:7.0.12-2","5:7.0.13-1","5:7.0.13-2","5:7.0.14-1","5:7.0.14-2","5:7.0.15-1~deb12u1","5:7.0.15-1~deb12u2","5:7.0.15-1~deb12u3","5:7.0.15-1~deb12u4","5:7.0.15-1~deb12u5","5:7.0.15-1~deb12u6","5:7.0.15-1~deb12u7","5:7.0.15-1~deb12u8","5:7.0.15-1~deb12u9"]},{"source":"osv","ecosystem":"Debian:13","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5:8.0.2-3","5:8.0.2-3+deb13u1","5:8.0.2-3+deb13u2","5:8.0.2-3+deb13u3","5:8.0.4-1","5:8.0.5-1","5:8.0.6-1","5:8.0.6-2","5:8.0.6-3","5:8.4.0-1","5:8.6.1-1","5:8.6.2-1","5:8.6.3-1"]},{"source":"osv","ecosystem":"Debian:14","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:8.0.6-3"}]}],"versions":["5:8.0.2-3","5:8.0.4-1","5:8.0.5-1","5:8.0.6-1","5:8.0.6-2"]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.16-2.oe2203sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.16-2.oe2403sp1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.16-2.oe2403sp3"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.16-2.oe2403sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.2.16-1.module+el9.8.0+24745+654dcf03"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"redis-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.2.16-1.module+el9.8.0+24745+654dcf03"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"redis-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.2.16-1.module+el9.8.0+24745+654dcf03"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"redis-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.2.16-1.module+el9.8.0+24745+654dcf03"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"redis-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.2.16-1.module+el9.8.0+24745+654dcf03"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.2.16-1.module+el9.6.0+24910+8b24772d"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"redis-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.2.16-1.module+el9.6.0+24910+8b24772d"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"redis-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.2.16-1.module+el9.6.0+24910+8b24772d"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"redis-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.2.16-1.module+el9.6.0+24910+8b24772d"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"redis-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.2.16-1.module+el9.6.0+24910+8b24772d"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.12-2.module+el9.4.0+24911+6845972a.9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"redis-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.12-2.module+el9.4.0+24911+6845972a.9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"redis-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.12-2.module+el9.4.0+24911+6845972a.9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"redis-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.12-2.module+el9.4.0+24911+6845972a.9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"redis-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.12-2.module+el9.4.0+24911+6845972a.9"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"valkey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.10-160000.2.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"valkey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.10-160000.2.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.4-150600.3.33.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.4-150600.3.33.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"redis7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.8-150500.3.40.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"redis7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.8-150500.3.40.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"redis7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.8-150500.3.40.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"redis7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.8-150500.3.40.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"redis7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.8-150600.8.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"redis7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.8-150600.8.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"valkey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.10-150600.13.31.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"valkey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.10-150600.13.31.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"valkey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.10-150700.3.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"valkey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.12-150700.3.29.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"valkey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.12-150600.13.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"valkey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.12-150600.13.34.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:7.0.15-1ubuntu0.24.04.5"}]}],"versions":["5:7.0.12-1","5:7.0.14-1","5:7.0.14-2","5:7.0.15-1","5:7.0.15-1build1","5:7.0.15-1build2","5:7.0.15-1ubuntu0.24.04.1","5:7.0.15-1ubuntu0.24.04.2","5:7.0.15-1ubuntu0.24.04.3","5:7.0.15-1ubuntu0.24.04.4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:8.0.5-1ubuntu0.1"}]}],"versions":["5:8.0.2-3build1","5:8.0.2-3ubuntu0.25.10.1","5:8.0.5-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:6.0.16-1ubuntu1.2"}]}],"versions":["5:6.0.15-1","5:6.0.16-1","5:6.0.16-1build1","5:6.0.16-1ubuntu1","5:6.0.16-1ubuntu1.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:7.0.15-1ubuntu0.24.04.5"}]}],"versions":["5:7.0.12-1","5:7.0.14-1","5:7.0.14-2","5:7.0.15-1","5:7.0.15-1build1","5:7.0.15-1build2","5:7.0.15-1ubuntu0.24.04.1","5:7.0.15-1ubuntu0.24.04.2","5:7.0.15-1ubuntu0.24.04.3","5:7.0.15-1ubuntu0.24.04.4"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:8.0.5-1ubuntu0.1"}]}],"versions":["5:8.0.2-3build1","5:8.0.2-3ubuntu0.25.10.1","5:8.0.5-1"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"valkey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.2-3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"valkey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.10-160000.2.1"}]}]}],"products":[{"vendor":"red hat","product":"pen drive powered by red hat lightspeed"},{"vendor":"red hat","product":"red hat 3scale api management platform 2"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat enterprise linux 9.4 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9.6 extended update support"},{"vendor":"red hat","product":"red hat hardened images"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:3443","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:3507","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:65120","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:69520","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:69521","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-92925","tags":["vdb-entry","x_refsource_REDHAT","advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2535971","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://github.com/redis/redis/commit/37894faeea11e2db28b9fc2af378a762d2c36523","tags":["fix","article"]},{"url":"https://github.com/redis/redis/pull/15263","tags":["fix","article"]},{"url":"https://github.com/redis/redis/releases/tag/8.10.0","tags":["web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92925","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-3gvw-xg56-j2xm"},{"url":"https://access.redhat.com/security/cve/CVE-2025-67733","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-21863","tags":["report"]},{"url":"https://bugzilla.redhat.com/2442025","tags":["report"]},{"url":"https://bugzilla.redhat.com/2442026","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-3507.html","tags":["advisory"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-92925.html","tags":["report"]},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92925.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-92925","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4400","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62356","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81934","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4401","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4402","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4403","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506985","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2513105","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2525226","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_65120.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-66373","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-66373","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66373","tags":["advisory"]},{"url":"https://github.com/berabuddies/redis-poc","tags":["article"]},{"url":"https://github.com/redis/redis/compare/8.6.4...8.8.0","tags":["article"]},{"url":"https://github.com/redis/redis/pull/15081","tags":["article"]},{"url":"https://news.ycombinator.com/item?id=49024938","tags":["article"]},{"url":"https://x.com/Fried_rice/status/2080059356322918777","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-72568","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-72568","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-81934","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-81934","tags":["advisory"]},{"url":"https://github.com/redis/redis/commit/6d088c335d5c3ec49a6c28486140b498e70b7834","tags":["article"]},{"url":"https://github.com/v12-security/pocs/tree/main/redis/server_ssl","tags":["article"]},{"url":"https://raw.githubusercontent.com/redis/redis/8.10/00-RELEASENOTES","tags":["article"]},{"url":"https://raw.githubusercontent.com/redis/redis/8.2/00-RELEASENOTES","tags":["article"]},{"url":"https://raw.githubusercontent.com/redis/redis/8.4/00-RELEASENOTES","tags":["article"]},{"url":"https://raw.githubusercontent.com/redis/redis/8.6/00-RELEASENOTES","tags":["article"]},{"url":"https://raw.githubusercontent.com/redis/redis/8.8/00-RELEASENOTES","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-92925","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_69520.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_69521.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623986-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1281417","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92925","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264370-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264375-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264377-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264491-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264493-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265092-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1288118","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265102-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-92925","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8866-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-81934","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-92925","title":"Redis: redis: out-of-bounds read via crafted cluster bus packets","description":"A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-carrying extensions for null-termination. This oversight allows a remote attacker to craft a malicious packet, leading to an out-of-bounds read when the packet's payload is processed. Successful exploitation of this vulnerability could result in the disclosure of sensitive information or a remote denial of service (DoS).","status":"published","published":"2026-09-17T11:48:04.664Z","modified":"2026-10-28T00:27:11.442Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T13:48:24.536396Z"}],"euvd":[{"id":"EUVD-2026-81460","description":"A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-carrying extensions for null-termination. This oversight allows a remote attacker to craft a malicious packet, leading to an out-of-bounds read when the packet's payload is processed. Successful exploitation of this vulnerability could result in the disclosure of sensitive information or a remote denial of service (DoS).","status":"published","published":"2026-09-17T11:48:04Z","modified":"2026-11-05T00:09:53Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-05T01:48:37.947628Z"}],"ghsa":[{"id":"GHSA-3gvw-xg56-j2xm","title":"In Redis community the cluster bus PING/PONG/MEET packet parser validated extension padding\nand...","description":"In Redis community the cluster bus PING/PONG/MEET packet parser validated extension padding\nand total length but never checked that string-carrying extensions are\nproperly null-terminated, allowing a crafted packet to trigger\nout-of-bounds reads when the payload is later consumed as a C string. This vulnerability can potentially lead to loss of confidentiality or remote denial of service. Redis Software / Redis Enterprise are not affected by this issue.","status":"published","published":"2026-09-17T12:32:03Z","modified":"2026-10-28T03:31:46Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:14:32.579072Z"}],"nvd":[{"id":"CVE-2026-92925","description":"A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-carrying extensions for null-termination. This oversight allows a remote attacker to craft a malicious packet, leading to an out-of-bounds read when the packet's payload is processed. Successful exploitation of this vulnerability could result in the disclosure of sensitive information or a remote denial of service (DoS).","status":"published","published":"2026-09-17T12:18:31.063Z","modified":"2026-11-05T01:17:23.817Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-125"],"updated_at":"2026-11-05T06:56:39.603296Z"}],"osv":[{"id":"CVE-2026-92925","title":"Redis: redis: out-of-bounds read via crafted cluster bus packets","description":"A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-carrying extensions for null-termination. This oversight allows a remote attacker to craft a malicious packet, leading to an out-of-bounds read when the packet's payload is processed. Successful exploitation of this vulnerability could result in the disclosure of sensitive information or a remote denial of service (DoS).","status":"published","published":"2026-09-17T11:48:04.664Z","modified":"2026-11-06T01:07:23.390885144Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"cwes":["CWE-125"],"updated_at":"2026-11-06T01:32:47.895286Z"},{"id":"DEBIAN-CVE-2026-92925","description":"A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-carrying extensions for null-termination. This oversight allows a remote attacker to craft a malicious packet, leading to an out-of-bounds read when the packet's payload is processed. Successful exploitation of this vulnerability could result in the disclosure of sensitive information or a remote denial of service (DoS).","status":"published","published":"2026-09-17T12:18:31.063Z","modified":"2026-11-05T09:47:32.948597985Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-05T13:31:24.64316Z"},{"id":"OESA-2026-4400","title":"redis security update","description":"Redis is an advanced key-value store. It is often referred to as a dattructure server since keys can contain strings, hashes ,lists, sets anorted sets.\r\n\r\nSecurity Fix(es):\n\nIn the Linux kernel, the following vulnerability has been resolved: cifs: Fix missing credit release on failure in cifs_issue_read() Fix missing release of credits in the failure path in cifs_issue_read() lest retrying the subreq just overwrites the credits value.(CVE-2026-62356)\n\nRedis contains a use-after-free vulnerability in the \u0026apos;tlsProcessPendingData()\u0026apos; function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the privileges of the Redis server. Fixed in Redis 8.2.9, 8.4.6, 8.6.6, 8.8.2, and 8.10.1.(CVE-2026-81934)\n\nA vulnerability, which was classified as critical, was found in Redis up to 8.8.1/8.9.x.CWE is classifying the issue as CWE-125. The product reads data past the end, or before the beginning, of the intended buffer.This is going to have an impact on confidentiality, integrity, and availability.Upgrading to version 8.10.0 eliminates this vulnerability.(CVE-2026-92925)","status":"published","published":"2026-10-16T12:00:11Z","modified":"2026-10-16T12:15:20.424578505Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"OESA-2026-4401","title":"redis security update","description":"Redis is an advanced key-value store. It is often referred to as a dattructure server since keys can contain strings, hashes ,lists, sets anorted sets.\r\n\r\nSecurity Fix(es):\n\nIn the Linux kernel, the following vulnerability has been resolved: cifs: Fix missing credit release on failure in cifs_issue_read() Fix missing release of credits in the failure path in cifs_issue_read() lest retrying the subreq just overwrites the credits value.(CVE-2026-62356)\n\nRedis contains a use-after-free vulnerability in the \u0026apos;tlsProcessPendingData()\u0026apos; function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the privileges of the Redis server. Fixed in Redis 8.2.9, 8.4.6, 8.6.6, 8.8.2, and 8.10.1.(CVE-2026-81934)\n\nA vulnerability, which was classified as critical, was found in Redis up to 8.8.1/8.9.x.CWE is classifying the issue as CWE-125. The product reads data past the end, or before the beginning, of the intended buffer.This is going to have an impact on confidentiality, integrity, and availability.Upgrading to version 8.10.0 eliminates this vulnerability.(CVE-2026-92925)","status":"published","published":"2026-10-16T12:00:12Z","modified":"2026-10-16T12:15:21.275872115Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"OESA-2026-4402","title":"redis security update","description":"Redis is an advanced key-value store. It is often referred to as a dattructure server since keys can contain strings, hashes ,lists, sets anorted sets.\r\n\r\nSecurity Fix(es):\n\nIn the Linux kernel, the following vulnerability has been resolved: cifs: Fix missing credit release on failure in cifs_issue_read() Fix missing release of credits in the failure path in cifs_issue_read() lest retrying the subreq just overwrites the credits value.(CVE-2026-62356)\n\nRedis contains a use-after-free vulnerability in the \u0026apos;tlsProcessPendingData()\u0026apos; function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the privileges of the Redis server. Fixed in Redis 8.2.9, 8.4.6, 8.6.6, 8.8.2, and 8.10.1.(CVE-2026-81934)\n\nA vulnerability, which was classified as critical, was found in Redis up to 8.8.1/8.9.x.CWE is classifying the issue as CWE-125. The product reads data past the end, or before the beginning, of the intended buffer.This is going to have an impact on confidentiality, integrity, and availability.Upgrading to version 8.10.0 eliminates this vulnerability.(CVE-2026-92925)","status":"published","published":"2026-10-16T12:00:13Z","modified":"2026-10-16T12:15:20.429842547Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"OESA-2026-4403","title":"redis security update","description":"Redis is an advanced key-value store. It is often referred to as a dattructure server since keys can contain strings, hashes ,lists, sets anorted sets.\r\n\r\nSecurity Fix(es):\n\nIn the Linux kernel, the following vulnerability has been resolved: cifs: Fix missing credit release on failure in cifs_issue_read() Fix missing release of credits in the failure path in cifs_issue_read() lest retrying the subreq just overwrites the credits value.(CVE-2026-62356)\n\nRedis contains a use-after-free vulnerability in the \u0026apos;tlsProcessPendingData()\u0026apos; function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the privileges of the Redis server. Fixed in Redis 8.2.9, 8.4.6, 8.6.6, 8.8.2, and 8.10.1.(CVE-2026-81934)\n\nA vulnerability, which was classified as critical, was found in Redis up to 8.8.1/8.9.x.CWE is classifying the issue as CWE-125. The product reads data past the end, or before the beginning, of the intended buffer.This is going to have an impact on confidentiality, integrity, and availability.Upgrading to version 8.10.0 eliminates this vulnerability.(CVE-2026-92925)","status":"published","published":"2026-10-16T12:00:13Z","modified":"2026-10-16T12:15:20.426826983Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"RHSA-2026:65120","title":"Red Hat Security Advisory: redis:7 security update","status":"published","published":"2026-09-09T10:20:19Z","modified":"2026-10-10T10:17:13Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:69520","title":"Red Hat Security Advisory: redis:7 security update","status":"published","published":"2026-09-22T10:20:01Z","modified":"2026-10-10T10:19:06Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:69521","title":"Red Hat Security Advisory: redis:7 security update","status":"published","published":"2026-09-22T10:20:02Z","modified":"2026-10-10T10:19:06Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"UBUNTU-CVE-2026-92925","description":"A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-carrying extensions for null-termination. This oversight allows a remote attacker to craft a malicious packet, leading to an out-of-bounds read when the packet's payload is processed. Successful exploitation of this vulnerability could result in the disclosure of sensitive information or a remote denial of service (DoS).","status":"published","published":"2026-09-17T12:18:00Z","modified":"2026-10-08T12:55:29.552906028Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:57:40.980117Z"},{"id":"ALSA-2026:3507","title":"Important: valkey security update","description":"Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set. In order to achieve its outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log. Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth. Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave like a cache. You can use Valkey from most programming languages also.  \n\nSecurity Fix(es):  \n\n  * Valkey: Valkey: Data tampering and denial of service via improper null character handling in Lua scripts (CVE-2025-67733)\n  * valkey: Valkey: Denial of Service via invalid clusterbus packet (CVE-2026-21863)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-03-02T00:00:00Z","modified":"2026-10-29T11:42:20.333103222Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"openSUSE-SU-2026:11951-1","title":"valkey-9.1.2-3.1 on GA media","description":"These are all security issues fixed in the valkey-9.1.2-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-01T00:00:00Z","modified":"2026-10-02T18:23:13.125273251Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:21985-1","title":"Security update for valkey","description":"This update for valkey fixes the following issue:\n\n- CVE-2026-92925: failure to properly validate string-carrying extensions for null-termination in the cluster bus packet\n  parser can lead to an out-of-bounds read (bsc#1281417).\n","status":"published","published":"2026-09-30T20:24:10Z","modified":"2026-10-01T17:30:06.790776585Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:23986-1","title":"Security update for valkey","description":"This update for valkey fixes the following issue:\n\n- CVE-2026-92925: failure to properly validate string-carrying extensions for null-termination in the cluster bus packet\n  parser can lead to an out-of-bounds read (bsc#1281417).\n","status":"published","published":"2026-09-30T20:18:02Z","modified":"2026-10-06T17:23:09.0993642Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:4370-1","title":"Security update for redis","description":"This update for redis fixes the following issue:\n\n- CVE-2026-92925: failure to properly validate string-carrying extensions for null-termination in the cluster bus packet\n  parser can lead to an out-of-bounds read (bsc#1281417).\n","status":"published","published":"2026-09-28T15:09:18Z","modified":"2026-09-29T09:15:08.298224459Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4375-1","title":"Security update for redis7","description":"This update for redis7 fixes the following issue:\n\n- CVE-2026-92925: failure to properly validate string-carrying extensions for null-termination in the cluster bus packet\n  parser can lead to an out-of-bounds read (bsc#1281417).\n","status":"published","published":"2026-09-28T15:15:40Z","modified":"2026-09-29T09:15:10.996047834Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4377-1","title":"Security update for redis7","description":"This update for redis7 fixes the following issue:\n\n- CVE-2026-92925: failure to properly validate string-carrying extensions for null-termination in the cluster bus packet\n  parser can lead to an out-of-bounds read (bsc#1281417).\n","status":"published","published":"2026-09-28T15:16:55Z","modified":"2026-09-29T09:15:11.240186017Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4491-1","title":"Security update for valkey","description":"This update for valkey fixes the following issue:\n\n- CVE-2026-92925: failure to properly validate string-carrying extensions for null-termination in the cluster bus packet\n  parser can lead to an out-of-bounds read (bsc#1281417).\n","status":"published","published":"2026-10-05T13:22:15Z","modified":"2026-10-06T11:15:10.496572179Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4493-1","title":"Security update for valkey","description":"This update for valkey fixes the following issue:\n\n- CVE-2026-92925: failure to properly validate string-carrying extensions for null-termination in the cluster bus packet\n  parser can lead to an out-of-bounds read (bsc#1281417).\n","status":"published","published":"2026-10-05T13:22:48Z","modified":"2026-10-06T11:15:10.795223574Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:5092-1","title":"Security update for valkey","description":"This update for valkey fixes the following issues:\n\n- CVE-2026-92925: failure to properly validate string-carrying extensions for null-termination in the cluster bus packet\n  parser can lead to an out-of-bounds read.\n- Integer truncation in Valkey cluster publish message construction causes a heap buffer overflow (bsc#1288118).\n\nUpdate to 8.0.12:\n \nSecurity fixes:\n\n * (GHSA-f4q9-j22m-xqq9, bsc#1288118) Fix a heap buffer overflow in cluster\n Pub/Sub message construction that could allow an authenticated client to\n potentially execute arbitrary code by publishing an oversized message\n \nFor full changelog see:\n \n https://github.com/valkey-io/valkey/releases/tag/8.0.12\n https://github.com/valkey-io/valkey/releases/tag/8.0.11\n","status":"published","published":"2026-11-04T08:15:52Z","modified":"2026-11-04T23:00:26.595530743Z","updated_at":"2026-11-04T23:09:59.08306Z"},{"id":"SUSE-SU-2026:5102-1","title":"Security update for valkey","description":"This update for valkey fixes the following issues:\n\n- Refresh patch for CVE-2026-92925: failure to properly validate string-carrying extensions for null-termination in the\n  cluster bus packet parser can lead to an out-of-bounds read.\n- Integer truncation in Valkey cluster publish message construction causes a heap buffer overflow (bsc#1288118).\n\nUpdate to 8.0.12.\n \nSecurity fixes:\n\n * (GHSA-f4q9-j22m-xqq9, bsc#1288118) Fix a heap buffer overflow in cluster\n Pub/Sub message construction that could allow an authenticated client to\n potentially execute arbitrary code by publishing an oversized message\n \nFor full changelog see:\n \n https://github.com/valkey-io/valkey/releases/tag/8.0.12\n https://github.com/valkey-io/valkey/releases/tag/8.0.11\n","status":"published","published":"2026-11-04T18:08:32Z","modified":"2026-11-05T13:15:07.706234398Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"USN-8866-1","title":"redis vulnerabilities","description":"It was discovered that Redis did not properly manage memory when handling\nthe TLS pending-data list. A remote attacker could possibly use this issue\nto execute arbitrary code. (CVE-2026-81934)\n\nIt was discovered that Redis incorrectly handled certain inputs when\nprocessing cluster bus packets. A remote attacker could possibly use this\nissue to expose sensitive information or cause a denial of service. This\nissue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-92925)","status":"published","published":"2026-10-06T03:02:05Z","modified":"2026-10-08T12:58:04.578061557Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}