CVE-2026-21863 is an input validation vulnerability in Valkey's clusterbus ping extension packets. A malicious actor with network access to the Valkey clusterbus port can send specially crafted invalid packets that trigger an out-of-bounds read, causing the Valkey service to crash and resulting in a denial-of-service condition. The vulnerability does not affect confidentiality or integrity but has a high impact on availability. It affects Valkey deployments with exposed cluster bus connections. Red Hat rates this issue as high severity due to the ease of remote exploitation and the potential to repeatedly crash the service. The recommended mitigation is to restrict network access to the clusterbus port to trusted hosts only. No official patch status is explicitly stated in the advisory, so patch status is not yet confirmed.

Successful exploitation causes a denial-of-service by crashing the Valkey service through an out-of-bounds read triggered by invalid clusterbus packets. There is no impact on confidentiality or integrity. The availability impact is rated high because the service can be repeatedly crashed remotely, disrupting operations. The vulnerability requires network access to the clusterbus port, which is commonly exposed in Valkey deployments.

Red Hat advises restricting network access to the Valkey clusterbus port by configuring network access control lists (ACLs) or firewall rules to allow only trusted hosts to connect. This limits the attack surface and prevents unauthorized actors from sending malicious packets. Patch status is not explicitly confirmed; therefore, users should monitor Red Hat advisories for updates. No indication that the issue is already mitigated or that no action is required.