The vulnerability exists in the Redis Open Source cluster bus packet parser for PING/PONG/MEET packets. While extension padding and total length are validated, the parser does not ensure that string-carrying extensions are properly null-terminated. This allows crafted packets to cause out-of-bounds reads when the payload is later processed as a C string. The issue can result in information disclosure or remote denial of service. Redis Software and Redis Enterprise variants are not impacted.

Exploitation of this vulnerability can lead to loss of confidentiality by reading memory out-of-bounds and may cause remote denial of service. There is no indication of active exploitation in the wild. The CVSS 4.0 score is 6.0 (medium severity), reflecting the potential for partial confidentiality loss and denial of service via remote attack with low attack complexity and no privileges required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fixes are provided, users should monitor Redis advisories for updates. Redis Software and Redis Enterprise users are not affected and do not require action for this issue.