CVE-2026-88382
Awaiting Analysis Awaiting Analysis - Queue

Uncontrolled Memory Allocation in Hiredis RESP Parser

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: MITRE

Description
hiredis commit 29ea279 (post-v1.5.0) contains an uncontrolled memory allocation vulnerability in its RESP aggregate parser.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-10-15
AI Q&A
2026-09-24
EPSS Evaluated
2026-10-14
NVD
CVE-2026-88382
EUVD
EUVD-2026-86315

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
redis hiredis From 1.5.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-789 The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an uncontrolled memory allocation issue in the hiredis library's RESP aggregate parser. An attacker can send a specially crafted MAP or ARRAY header with a maximum element count, causing the system to request up to 68.7 GB of memory. This happens because the element count bypasses bounds checking in the allocation function.

Detection Guidance

Detecting this vulnerability requires monitoring for abnormal memory usage or crashes in applications using hiredis. Check for processes using hiredis with high memory consumption or frequent OOM errors. Use system monitoring tools like 'top', 'htop', or 'ps' to observe memory usage spikes in redis or applications linked to hiredis.

Impact Analysis

This vulnerability can lead to a denial-of-service (DoS) attack. An attacker can crash or severely degrade the performance of any application using the vulnerable hiredis version by sending a single malicious packet. This disrupts service availability for users.

Compliance Impact

This vulnerability could lead to denial-of-service conditions, potentially disrupting services handling sensitive data. For GDPR, it may impact availability of personal data processing systems. For HIPAA, it could affect the integrity and availability of protected health information systems.

Mitigation Strategies

Immediately update hiredis to a patched version that includes bounds checking for RESP aggregate parsing. If updating is not possible, implement network-level protections to block malformed RESP MAP or ARRAY headers with excessive element counts. Monitor for exploitation attempts and restrict untrusted network access to redis instances.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88382. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart