CVE-2026-97057High· 7.5▾ Twilightredis-parser through 3.0.0 fails to validate the multi-bulk length value in RESP protocol parsing, allowing attackers to trigger an uncaught RangeError by supplying an excessively large declared length. A malicious or compromised Redis e…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 26.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
redis-parser through 3.0.0 fails to validate the multi-bulk length value in RESP protocol parsing, allowing attackers to trigger an uncaught RangeError by supplying an excessively large declared length. A malicious or compromised Redis endpoint can deliver a crafted RESP header with a length above 2^32-1 to crash the Node.js client process.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-93435High· 7.5redis-parser through 3.0.0 contains a denial of service vulnerability in the RESP protocol parser that allows malicious Redis endpoints to crash the client process through unbounded recursion on nested arrays
CVE-2026-70405Medium· 6.3Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP snmp allows a remote attacker to degrade availability by sending an SNMP message containing a BER INTEGER whose length field is arbitrarily large. snmp_pdus:…
CVE-2026-116172Medium· 5.9vllm: vLLM: Denial of Service via improper input validation in Rust gRPC interface (CVE-2026-116172)
CVE-2026-98434Medium· 5.5kernel: sysctl: Check range in proc_dointvec_ms_jiffies_minmax (CVE-2026-98434)
CVE-2026-98556Medium· 5.5kernel: gve: DQO: reject TSO packets with an out of range MSS (CVE-2026-98556)
CVE-2026-98585Medium· 4.4kernel: eth: fbnic: Avoid rounding zero ring sizes (CVE-2026-98585)