CVE-2026-72568

Name of the Vulnerable Software and Affected Versions Redis versions prior to 8.8.2

Description An out-of-bounds read occurs when the getPingExtLength() function in the cluster bus message parser fails to validate extension length fields against the actual remaining buffer size. This allows an adjacent unauthenticated attacker to cause a denial of service or information disclosure by sending a specially crafted PING message to the Redis Cluster Bus port, forcing the parser to read beyond the allocated buffer boundary.

Recommendations Update Redis to version 8.8.2 or later.