CVE-2026-85522: Out-of-Bounds Read in valkey-io valkey

The vulnerability CVE-2026-85522 affects valkey-io valkey up to versions 9.5.4 and 9.1.0. It is caused by an out-of-bounds read triggered by manipulating the job_name argument in the createSlotImportJob function of src/cluster_migrateslots.c, part of the Slot Migration component. This flaw allows remote attackers to read memory outside the intended bounds, potentially leading to information disclosure or application instability. The issue is addressed by upgrading to valkey versions 9.0.5 and 9.1.1, where the patch identified by commit f4dc3ca09eb650c2fe14060090a41c524eca803f fixes the vulnerability. The CVSS 4.0 base score is 6.9, reflecting medium severity with network attack vector, no privileges or user interaction required, and limited impact on availability.

An attacker can remotely trigger an out-of-bounds read in the vulnerable valkey versions, which may lead to information disclosure or application instability. The vulnerability does not require privileges or user interaction to exploit. The presence of public exploit code increases the risk of exploitation. However, the impact is limited to information disclosure and does not include code execution or privilege escalation.

Upgrading valkey to versions 9.0.5 or 9.1.1 fully addresses this vulnerability. Users should apply these updates promptly. No other mitigation or temporary workaround is indicated. Patch status is confirmed by the vendor's version upgrade recommendations.