VulnerabilityPublished
ZDI-26-833: Valkey clusterCreatePublishMsgBlock Numeric Truncation Error Remote Code Execution Vulnerability
Source Zero Day Initiative
0
Severity
HighRated High by Zero Day Initiative
Data as of 28 Oct 2026, 22:32 UTC
What to do
AI-suggested
Until a fix is available, restrict access to authenticated users and monitor for suspicious activity related to clusterCreatePublishMsgBlock usage.
Description
A numeric truncation error vulnerability in Valkey's clusterCreatePublishMsgBlock function allows remote authenticated attackers to execute arbitrary code. The vulnerability requires authentication and has been rated with a high severity score by the Zero Day Initiative.
References
Community reviews
Loading reviews…