Redis patches a heap overflow in cluster-mode pub/sub
Oversized PUBLISH and SPUBLISH messages over the cluster bus could overflow a heap buffer in Redis Cluster. Seven release lines got the fix on 26 October, with no CVE number assigned yet.
Redis shipped a security release on 26 October fixing a heap buffer overflow in Redis Cluster’s pub/sub propagation. When a PUBLISH or SPUBLISH message’s combined channel and payload size pushed the cluster-bus frame past what a 32-bit length field can hold, roughly 4GB, the length got truncated, Redis allocated an undersized buffer, and the memcpy that followed overflowed the heap.
The fix adds a length check before allocation: oversized publishes are now rejected with “Publish message is too large for cluster propagation” instead of corrupting memory. Patched versions are 8.10.3, 8.8.4, 8.6.8, 8.4.8, 8.2.11, 7.4.12 and 7.2.17, all released the same day and all marked with Redis’s “SECURITY” update urgency.
Why it matters: this only bites Redis running in Cluster mode, and only when a client can push a single pub/sub message past the 4GB mark. If you accept client-controlled payloads into pub/sub channels on a cluster, patch now rather than waiting for the next maintenance window.
The caveat: Redis’s own release notes don’t give a CVE number or a severity score, and there’s no report yet of this being exploited. The fix shipped as a precaution alongside the version bump, not in response to an attack.