CVE-2026-86227
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
A vulnerability has been identified in valkey-io valkey up to 9.0.5/9.1.1, involving an out-of-bounds read in the kvstoreGetHashtable function of src/kvstore.c via manipulation of the didx argument. The attack can be initiated remotely but requires cluster mode and attacker-controlled dump.rdb at startup, making exploitation difficult. The exploit has been made public, and a patch is available.
Risk Assessment
The vulnerability could allow an attacker to cause a denial of service during server startup if they can supply a crafted dump.rdb file. This may lead to service disruption.
Recommendation
It is recommended to apply the available patch immediately and restrict access to the data directory and replication feeds to prevent an attacker from supplying a malicious file.
Other vulnerabilities in valkey
See all- CVE-2026-85522Medium
A vulnerability was detected in valkey-io valkey up to 9.5.4/9.1.0. Affected by this vulnerability is the function createSlotImportJob of the file src/cluster_migrateslots.c of the component Slot Migration. The manipulation of the argument job_name results in out-of-bounds read. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version 9.0.5 and 9.1.1 addresses this issue. The patch is identified as f4dc3ca09eb650c2fe14060090a41c524eca803f. Upgrading the affected component is advised.
- CVE-2026-82677Low
A vulnerability was determined in valkey-io valkey 9.1.0. The function moduleTimerHandler in src/module.c of the Module Timer Subsystem causes double free. The attack can be initiated remotely, and the exploit is public. A patch is available.
- CVE-2026-82631Low
A security flaw was discovered in valkey-io valkey 9.1.0. The function handleClientsBlockedOnKey in src/blocked.c of the Blocked-on-keys Subsystem is vulnerable to use after free. The attack may be performed remotely but is difficult to exploit due to high complexity. The exploit is public, and a patch is available.
- CVE-2026-63639High
Use-after-free vulnerability in Valkey prior to versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1. The RESTORE command accepts a malformed RDB stream that assigns one NACK to multiple consumers, potentially allowing remote code execution.
- CVE-2026-56684High
Valkey, a distributed key-value database, contains a use-after-free vulnerability in the tlsProcessPendingData function. An authenticated client can trigger CLIENT KILL, causing deletion of a node from the list and potentially leading to server crash or remote code execution when TLS is enabled. The issue is fixed in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1.
- CVE-2026-27623High
A vulnerability in Valkey from version 9.0.0 to 9.0.2 allows an attacker with network access to crash the server by sending a specially crafted request. The issue is caused by improper reset of networking state after processing an empty request, leading to an assertion failure and system abort.
- CVE-2026-21863High
A vulnerability in Valkey allows an attacker with access to the clusterbus port to send a malformed packet, potentially causing an out-of-bounds read and system crash. The issue stems from missing validation of the ping extension packet location within the buffer.
- CVE-2025-67733High
A vulnerability in Valkey allows a malicious user to inject arbitrary information into the client response stream via Lua scripts. The issue stems from improper handling of null characters in the Lua script error handling code, potentially corrupting or tampering with data for other users on the same connection.
Original NVD description (English source)
A weakness has been identified in valkey-io valkey up to 9.0.5/9.1.1. This affects the function kvstoreGetHashtable of the file src/kvstore.c. This manipulation of the argument didx causes out-of-bounds read. It is possible to initiate the attack remotely. The attack is considered to have high complexity. It is indicated that the exploitability is difficult. The exploit has been made available to the public and could be used for attacks. Patch name: 4691888e7fab3df128f0bde5750c9fde2ae552fa. To fix this issue, it is recommended to deploy a patch. Exploitation requires cluster mode plus attacker-controlled dump.rdb at startup (data-dir write access, replication feed, or a stored crafted RDB) - an attacker-position DoS at boot, not network pre-auth. The issue report was closed stating it "is worth fixing for the sake of memory safety… but I don't think it meets our bar for a security disclosure."
Vulnerability data from NVD (NIST) · CISA KEV · EPSS