CVE-2026-86227valkey-io valkey kvstore.c kvstoreGetHashtable out-of-bounds
Updated under an hour ago ()
Does this affect you?
It affects valkey-io valkey. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
A weakness has been identified in valkey-io valkey up to 9.0.5/9.1.1. This affects the function kvstoreGetHashtable of the file src/kvstore.c. This manipulation of the argument didx causes out-of-bounds read. It is possible to initiate the attack remotely. The attack is considered to have high complexity. It is indicated that the exploitability is difficult. The exploit has been made available to the public and could be used for attacks. Patch name: 4691888e7fab3df128f0bde5750c9fde2ae552fa. To fix this issue, it is recommended to deploy a patch. Exploitation requires cluster mode plus attacker-controlled dump.rdb at startup (data-dir write access, replication feed, or a stored crafted RDB) - an attacker-position DoS at boot, not network pre-auth. The issue report was closed stating it "is worth fixing for the sake of memory safety… but I don't think it meets our bar for a security disclosure."
- CVSS
- 3.1 LOW (v3.1, CNA)CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
- Weakness (CWE)
- CWE-125, CWE-119
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- VulDB
- NVD analysis
- Deferred
- Record last updated
- Sep 9, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
valkey-io valkey valkey-io:valkey | 9.0.0; 9.0.1; 9.0.2; 9.0.3; 9.0.4; 9.0.5; 9.1.0; 9.1.1 | CNA record |
References
- https://vuldb.com/vuln/399380vdb-entry, technical-description
- https://vuldb.com/vuln/399380/ctisignature, permissions-required
- https://vuldb.com/cve/CVE-2026-86227third-party-advisory
- https://vuldb.com/submit/897659third-party-advisory
- https://github.com/valkey-io/valkey/issues/4222issue-tracking
- https://github.com/valkey-io/valkey/pull/4229issue-tracking, patch
- https://github.com/user-attachments/files/30195539/RDB.zipexploit
- https://github.com/valkey-io/valkey/commit/4691888e7fab3df128f0bde5750c9fde2ae552fapatch
- https://github.com/valkey-io/valkey/product
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.