AI Threat AlertCVE-2026-92925: Redis: cluster bus OOB read enables DoS and info leak
HIGHCVE-2026-92925 is an out-of-bounds read in the Redis cluster bus parser: PING, PONG and MEET packets carrying string extensions are not checked for null-termination, so a crafted packet can leak memory or crash the node. It matters for AI estates because Redis commonly backs feature stores, semantic caches, session and rate-limit state, and queues for LLM inference stacks, and Red Hat ships it inside many images, including RHOAI, RHEL AI, vLLM and Llama Stack. The practical risk is limited: exploitation needs adjacent-network access to the cluster bus port (typically 16379) with no authentication, EPSS is low at 0.004 (68th percentile), the CVE is not in CISA KEV, no public exploit or Nuclei template exists, and SSVC says TRACK. The availability impact is high (CVSS 7.1), though, because crashing a cluster node can stall inference caching and queueing. Apply the Red Hat errata (RHSA-2026:69521, 69520, 65120) or upgrade to Redis 8.10.0 or later, and make sure the cluster bus port is reachable only from other cluster members.
What is the risk?
Medium-high for clustered Redis exposed on flat or shared networks; low overall likelihood. CVSS 7.1 (AV:A/AC:L/PR:N/UI:N) means no credentials or user interaction are needed, but the attacker must be on the same network segment as the cluster bus. EPSS of 0.004 (68th percentile), no KEV listing, no public exploit and SSVC TRACK indicate no observed exploitation. Confidentiality impact is limited to a small out-of-bounds read, while availability impact is high because a remote crash of a cluster node is possible. Risk grows in multi-tenant Kubernetes or OpenShift clusters where pods share a flat network and the cluster bus port is not restricted by network policy.
How does the attack unfold?
What systems are affected?
How severe is it?
What is the attack surface?
What should I do?
1 step1) Patch: apply Red Hat errata RHSA-2026:69521, RHSA-2026:69520 and RHSA-2026:65120 for the affected images, or upgrade to Redis 8.10.0 or later (fix in redis/redis PR #15263, commit 37894fa). 2) Inventory: find Redis instances running with cluster-enabled yes, including those embedded in the listed images, and rebuild and redeploy containers on patched base images. 3) Network controls: restrict the cluster bus port (default client port + 10000) with firewalls, security groups or Kubernetes NetworkPolicies so only cluster members can reach it. 4) Use TLS for cluster bus traffic (tls-cluster yes) where supported, and do not expose Redis to untrusted segments. 5) Detection: alert on unexpected connections to the cluster bus port, repeated node crashes or restarts, and cluster failover events. 6) If you do not use cluster mode, document the instance as not exposed and keep it on the normal patch cycle.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-92925?
CVE-2026-92925 is an out-of-bounds read in the Redis cluster bus parser: PING, PONG and MEET packets carrying string extensions are not checked for null-termination, so a crafted packet can leak memory or crash the node. It matters for AI estates because Redis commonly backs feature stores, semantic caches, session and rate-limit state, and queues for LLM inference stacks, and Red Hat ships it inside many images, including RHOAI, RHEL AI, vLLM and Llama Stack. The practical risk is limited: exploitation needs adjacent-network access to the cluster bus port (typically 16379) with no authentication, EPSS is low at 0.004 (68th percentile), the CVE is not in CISA KEV, no public exploit or Nuclei template exists, and SSVC says TRACK. The availability impact is high (CVSS 7.1), though, because crashing a cluster node can stall inference caching and queueing. Apply the Red Hat errata (RHSA-2026:69521, 69520, 65120) or upgrade to Redis 8.10.0 or later, and make sure the cluster bus port is reachable only from other cluster members.
Is CVE-2026-92925 actively exploited?
No confirmed active exploitation of CVE-2026-92925 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-92925?
1) Patch: apply Red Hat errata RHSA-2026:69521, RHSA-2026:69520 and RHSA-2026:65120 for the affected images, or upgrade to Redis 8.10.0 or later (fix in redis/redis PR #15263, commit 37894fa). 2) Inventory: find Redis instances running with cluster-enabled yes, including those embedded in the listed images, and rebuild and redeploy containers on patched base images. 3) Network controls: restrict the cluster bus port (default client port + 10000) with firewalls, security groups or Kubernetes NetworkPolicies so only cluster members can reach it. 4) Use TLS for cluster bus traffic (tls-cluster yes) where supported, and do not expose Redis to untrusted segments. 5) Detection: alert on unexpected connections to the cluster bus port, repeated node crashes or restarts, and cluster failover events. 6) If you do not use cluster mode, document the instance as not exposed and keep it on the normal patch cycle.
What systems are affected by CVE-2026-92925?
This vulnerability affects the following AI/ML architecture patterns: Model serving and inference caching, Feature stores, Task queues and agent state stores, Semantic caches and session stores, Kubernetes/OpenShift AI platforms.
What is the CVSS score for CVE-2026-92925?
CVE-2026-92925 has a CVSS v3.1 base score of 7.1 (HIGH). The EPSS exploitation probability is 0.71%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0029Denial of AI ServiceAML.T0049Exploit Public-Facing ApplicationCompliance Controls Affected
What are the technical details?
Original Advisory
A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-carrying extensions for null-termination. This oversight allows a remote attacker to craft a malicious packet, leading to an out-of-bounds read when the packet's payload is processed. Successful exploitation of this vulnerability could result in the disclosure of sensitive information or a remote denial of service (DoS).
Exploitation Scenario
An attacker who has gained a foothold on a pod or host in the same network segment as a Redis Cluster used by an LLM serving platform scans for the cluster bus port. They send a crafted MEET or PING packet with an unterminated string extension. The parser reads past the buffer boundary, which crashes the node or returns adjacent memory contents. Repeated packets knock out cluster nodes, causing cache misses, stalled task queues and degraded inference latency, or an outage of the model-serving layer that depends on Redis state.
Weaknesses (CWE)
CWE-125 — Out-of-bounds Read: The product reads data past the end, or before the beginning, of the intended buffer.
- [Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
- [Architecture and Design] Use a language that provides appropriate memory abstractions.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:HReferences
- access.redhat.com/errata/RHSA-2026:3443vendor-advisoryx_refsource_REDHAT
- access.redhat.com/errata/RHSA-2026:3507vendor-advisoryx_refsource_REDHAT
- access.redhat.com/errata/RHSA-2026:65120vendor-advisoryx_refsource_REDHAT
- access.redhat.com/errata/RHSA-2026:69520vendor-advisoryx_refsource_REDHAT
- access.redhat.com/errata/RHSA-2026:69521vendor-advisoryx_refsource_REDHAT
- access.redhat.com/security/cve/CVE-2026-92925vdb-entryx_refsource_REDHAT
- bugzilla.redhat.com/show_bug.cgiissue-trackingx_refsource_REDHAT
- github.com/redis/redis/commit/37894faeea11e2db28b9fc2af378a762d2c36523
- github.com/redis/redis/pull/15263
- github.com/redis/redis/releases/tag/8.10.0
Timeline
Related Vulnerabilities
CVE-2026-6173210.0Decepticon: ChatML token injection yields sandbox RCE
Same package: vllmCVE-2024-110419.8vllm: RCE via unsafe pickle deserialization in MessageQueue
Same package: vllmCVE-2026-259609.8vllm: SSRF allows internal network access
Same package: vllmCVE-2025-472779.8vLLM: RCE via exposed TCPStore in distributed inference
Same package: vllmCVE-2024-90539.8vllm: RCE via unsafe pickle deserialization in RPC server
Same package: vllm