Redis supports a cluster bus feature that exchanges control messages over a dedicated port. In the vulnerable code path, the getPingExtLength() function reads an extension length field without checking that the value is within the bounds of the remaining data buffer. An attacker can forge a PING message that tricks the parser into reading past the end of the buffer, which can corrupt the heap, crash the server, or expose portions of memory. The reported CVSS score of 7.1 reflects the severity of an out‑of‑bounds read that can lead to service disruption or partial information disclosure.

The flaw was discovered in Redis releases up to and including version 8.8.1. Any deployment using 8.8.1 or an older release is vulnerable. All Redis servers that expose the cluster bus port (defaulting to 16379) to the network may be susceptible if the server is running in cluster mode.

The CVSS score indicates a moderate‑to‑high risk, and the EPSS score is not available, meaning the likelihood of exploitation is unknown but potentially significant. The vulnerability is listed as not in CISA KEV, so no confirmed public exploits have been reported. The likely attack vector is a network‑based, unauthenticated request that targets the cluster bus port. An attacker adjacent to the Redis cluster or with network access to the bus port can send a crafted PING packet to trigger the out‑of‑bounds read, potentially causing a server crash or leaking memory contents. The lack of authentication or input validation in the message parser is the root cause of the issue.