CVE-2026-72568

An out-of-bounds read vulnerability in Redis versions up to 8.8.1 allows unauthenticated adjacent attackers to exploit the system by sending a specially crafted PING message, potentially leading to denial of service or information disclosure. The vulnerability arises from improper validation of extension length fields in the cluster bus message parser, which can result in reading beyond the allocated buffer. Organizations using Redis should prioritize patching this vulnerability to mitigate risks associated with unauthorized access and service disruption.