Denial-of-Service in OpenCanary Redis Module

Executive Summary

CVE-2026-85219 is a Denial-of-Service (DoS) vulnerability in the Redis module of Thinkst Canary's OpenCanary 0.9.9. It allows an unauthenticated remote attacker to cause unconstrained memory usage by exploiting a protocol DoS, where the process fails to release memory under certain conditions.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires monitoring for unusual memory usage patterns in the OpenCanary process. Check for processes named opencanary or related to Redis using commands like 'ps aux | grep opencanary' or 'top -p $(pgrep opencanary)'. Monitor memory consumption with 'free -m' or 'htop' for abnormal spikes. Inspect network traffic to Redis ports (default 6379) for unexpected connections using 'netstat -tulnp | grep 6379' or 'ss -tulnp | grep 6379'.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to system slowdowns or crashes due to excessive memory consumption. It may disrupt services relying on OpenCanary, though it does not affect confidentiality or integrity of data.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily impacts system availability by causing memory exhaustion through a DoS attack. It does not directly affect data confidentiality or integrity, which are key concerns for GDPR and HIPAA. However, prolonged downtime could disrupt access to critical data, potentially leading to compliance issues if service availability is required by these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade OpenCanary to version 0.9.10 or later to patch the vulnerability. As a temporary workaround, disable the Redis module by editing opencanary.conf and setting 'redis.enabled': false, then restart the service. Ensure no critical services depend on the Redis module before disabling it.

Useful 0 Not Useful 0