CVE-2026-85219 - Vulnerability Details - OpenCVE

Denial-of-Service in Redis module in Thinkst Canary's OpenCanary 0.9.9 allows an unauthenticated remote attacker cause unconstrained memory usage.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Thinkst Applied Research	Opencanary

No data.

No data.

References

Link	Providers
https://github.com/thinkst/opencanary/security/advisories/GHSA-77jg-5rmj-77jx

History

Thu, 24 Sep 2026 04:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 21 Sep 2026 20:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Thinkst Applied Research Thinkst Applied Research opencanary
Vendors & Products		Thinkst Applied Research Thinkst Applied Research opencanary

Mon, 21 Sep 2026 19:45:00 +0000

Type	Values Removed	Values Added
Description		Denial-of-Service in Redis module in Thinkst Canary's OpenCanary 0.9.9 allows an unauthenticated remote attacker cause unconstrained memory usage.
Title		Denial-of-Service in the OpenCanary Redis service
Weaknesses		CWE-770
References		https://github.com/thinkst/opencanary/security/advisories/GHSA-77jg-5rmj-77jx
Metrics		cvssV3_1 `{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L'}`

MITRE

Status: PUBLISHED

Assigner: ThinkstAppliedResearch

Published: 2026-09-21T19:39:43.314Z

Updated: 2026-09-22T13:42:40.389Z

Reserved: 2026-09-03T14:04:45.649Z

Link: CVE-2026-85219

Vulnrichment

Updated: 2026-09-22T13:42:20.934Z

NVD

Status : Deferred

Published: 2026-09-21T20:17:36.807

Modified: 2026-09-22T19:41:38.447

Link: CVE-2026-85219

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-85219", "assignerOrgId": "0f2be0ad-3469-4e56-b38f-4eb96719b425", "state": "PUBLISHED", "assignerShortName": "ThinkstAppliedResearch", "dateReserved": "2026-09-03T14:04:45.649Z", "datePublished": "2026-09-21T19:39:43.314Z", "dateUpdated": "2026-09-22T13:42:40.389Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "0f2be0ad-3469-4e56-b38f-4eb96719b425", "shortName": "ThinkstAppliedResearch", "dateUpdated": "2026-09-21T19:39:43.314Z"}, "title": "Denial-of-Service in the OpenCanary Redis service", "datePublic": "2026-09-21T19:33:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-770", "description": "CWE-770 Allocation of resources without limits or throttling", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-130", "descriptions": [{"lang": "en", "value": "CAPEC-130 Excessive Allocation"}]}], "affected": [{"vendor": "Thinkst Applied Research", "product": "OpenCanary", "collectionURL": "https://pypi.org/project/opencanary/", "packageName": "opencanary", "repo": "https://github.com/thinkst/opencanary", "modules": ["Redis Module"], "versions": [{"status": "affected", "version": "0.4", "lessThan": "0.9.10", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Denial-of-Service in Redis module in Thinkst Canary's OpenCanary 0.9.9 allows an unauthenticated remote attacker cause unconstrained memory usage.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<span>Denial-of-Service in Redis module in Thinkst Canary's OpenCanary 0.9.9 allows an unauthenticated remote attacker cause unconstrained memory usage.</span><div><br></div>"}]}], "references": [{"url": "https://github.com/thinkst/opencanary/security/advisories/GHSA-77jg-5rmj-77jx", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "LOW", "baseSeverity": "LOW", "baseScore": 3.7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"}}], "configurations": [{"lang": "en", "value": "Redis module is enabled.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Redis module is enabled."}]}], "workarounds": [{"lang": "en", "value": "Disable the Redis module.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Disable the Redis module."}]}], "credits": [{"lang": "en", "value": "Teddy Thobane (rootkiTed)", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-22T13:36:56.950569Z", "id": "CVE-2026-85219", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-22T13:42:40.389Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-85219", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-22T13:36:56.950569Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-22T13:42:20.934Z"}}], "cna": {"title": "Denial-of-Service in the OpenCanary Redis service", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Teddy Thobane (rootkiTed)"}], "impacts": [{"capecId": "CAPEC-130", "descriptions": [{"lang": "en", "value": "CAPEC-130 Excessive Allocation"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/thinkst/opencanary", "vendor": "Thinkst Applied Research", "modules": ["Redis Module"], "product": "OpenCanary", "versions": [{"status": "affected", "version": "0.4", "lessThan": "0.9.10", "versionType": "semver"}], "packageName": "opencanary", "collectionURL": "https://pypi.org/project/opencanary/", "defaultStatus": "unaffected"}], "datePublic": "2026-09-21T19:33:00.000Z", "references": [{"url": "https://github.com/thinkst/opencanary/security/advisories/GHSA-77jg-5rmj-77jx", "tags": ["vendor-advisory"]}], "workarounds": [{"lang": "en", "value": "Disable the Redis module.", "supportingMedia": [{"type": "text/html", "value": "Disable the Redis module.", "base64": false}]}], "x_generator": {"engine": "Vulnogram 1.0.5"}, "descriptions": [{"lang": "en", "value": "Denial-of-Service in Redis module in Thinkst Canary's OpenCanary 0.9.9 allows an unauthenticated remote attacker cause unconstrained memory usage.", "supportingMedia": [{"type": "text/html", "value": "<span>Denial-of-Service in Redis module in Thinkst Canary's OpenCanary 0.9.9 allows an unauthenticated remote attacker cause unconstrained memory usage.</span><div><br></div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770 Allocation of resources without limits or throttling"}]}], "configurations": [{"lang": "en", "value": "Redis module is enabled.", "supportingMedia": [{"type": "text/html", "value": "Redis module is enabled.", "base64": false}]}], "providerMetadata": {"orgId": "0f2be0ad-3469-4e56-b38f-4eb96719b425", "shortName": "ThinkstAppliedResearch", "dateUpdated": "2026-09-21T19:39:43.314Z"}}}, "cveMetadata": {"cveId": "CVE-2026-85219", "state": "PUBLISHED", "dateUpdated": "2026-09-22T13:42:40.389Z", "dateReserved": "2026-09-03T14:04:45.649Z", "assignerOrgId": "0f2be0ad-3469-4e56-b38f-4eb96719b425", "datePublished": "2026-09-21T19:39:43.314Z", "assignerShortName": "ThinkstAppliedResearch"}, "dataVersion": "5.2"}