CVE-2026-85220 Denial-of-Service in the Thinkst Canary Redis service
Unauthenticated remote attackers can cause a denial of service in the Thinkst Canary honeypot if the Redis service is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-85220?
CVE-2026-85220 is a low-severity denial of service vulnerability in Thinkst Applied Research Canary, published on 21 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability in the Thinkst Canary honeypot Redis service allows an unauthenticated remote attacker to execute a Denial-of-Service attack against the honeypot.
The vulnerability is accessible when the Redis service is enabled only.
The Canary is NOT affected if the Redis service is disabled.
Thinkst has addressed this issue on all supported platforms.
New update files to address this issue are available on all platforms except Docker. For Docker customers, a new Docker image has been published which includes the patch. Customers with automatic updates enabled already have updates in distribution. If automatic updates are disabled, customers are advised to update their Canaries.
Workarounds are available for customers unable to update at this time.
Weakness: CWE-770
Which versions are affected by CVE-2026-85220?
How do I fix CVE-2026-85220?
No fix has been published for CVE-2026-85220 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-85220 being exploited?
There is no known exploitation of CVE-2026-85220 in the wild and no public exploit code.
Sources
Also known as GHSA-x7vx-qh4q-fg6x.