Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.7
CVE-2026-85219: OpenCanary Redis service can be made unavailable
CVE-2026-85219 · published 28 days ago
Summary
Version 0.9.9 of Thinkst Applied Research’s OpenCanary has a weakness in its Redis component that lets anyone on the network cause the program to use unlimited memory, which can stop it from working. This can interrupt monitoring and alerting functions. Install the latest OpenCanary update or apply the vendor’s patch, and restrict network access to the Redis service to trusted hosts.
What to do
- Update thinkst applied research opencanary to version 0.9.10 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| thinkst applied research | opencanary | < 0.9.10 |
Original advisory text
Denial-of-Service in the OpenCanary Redis service
Denial-of-Service in Redis module in Thinkst Canary's OpenCanary 0.9.9 allows an unauthenticated remote attacker cause unconstrained memory usage.
References
- https://github.com/thinkst/opencanary/security/advisories/GHSA-77jg-5rmj-77jx
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85219... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-85219 Vendor Advisory
- https://github.com/thinkst/opencanary Product
- https://pypi.org/project/opencanary/ Product
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-770Allocation of Resources Without Limits
Timeline
Published21 Sep 2026
Updated19 Oct 2026
First seen21 Sep 2026
Track software like this
Free during beta