An out‑of‑bounds read in Redis up to version 8.8.1 occurs when the PING message handler processes a specially crafted packet on the cluster bus port. The getPingExtLength() routine reads an extension length field without verifying the field falls within the bounds of the remaining data, allowing an attacker to corrupt the heap and trigger a crash or reveal internal memory contents. The vulnerability can be exploited by an adjacent, unauthenticated network user targeting the bus port, leading to denial of service or partial disclosure of sensitive data. The CVSS score of 7.1 reflects this moderate‑to‑high severity.

The flaw was discovered in Redis releases up to and including version 8.8.1. Any deployment using 8.8.1 or an older release is vulnerable. All Redis servers that expose the cluster bus port (defaulting to 16379) to the network may be susceptible if the server is running in cluster mode.

The CVSS score indicates a moderate‑to‑high risk, and the EPSS score is not available, meaning the likelihood of exploitation is unknown but potentially significant. The vulnerability is listed as not in CISA KEV, so no confirmed public exploits have been reported. The likely attack vector is a network‑based, unauthenticated request that targets the cluster bus port. An attacker adjacent to the Redis cluster or with network access to the bus port can send a crafted PING packet to trigger the out‑of‑bounds read, potentially causing a server crash or leaking memory contents. The lack of authentication or input validation in the message parser is the root cause of the issue.