CVE-2026-86227 is an out-of-bounds read vulnerability in the valkey-io valkey software affecting versions 9.0.0 through 9.1.1. The flaw exists in the kvstoreGetHashtable function in src/kvstore.c and is triggered by manipulation of the argument didx. Exploitation requires cluster mode and attacker-controlled dump.rdb at startup, which involves data-dir write access or a crafted replication feed. The attack complexity is high, and the exploitability is considered difficult. The vulnerability was acknowledged as a memory safety issue but was not deemed severe enough for a formal security disclosure. A patch is recommended to fix the issue.
A vulnerability was detected in valkey-io valkey up to 9.5.4/9.1.0. Affected by this vulnerability is the function createSlotImportJob of the file src/cluster_migrateslots.c of the component Slot Migration. The manipulation of the argument job_name results in out-of-bounds read. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version 9.0.5 and 9.1.1 addresses this issue. The patch is identified as f4dc3ca09eb650c2fe14060090a41c524eca803f. Upgrading the affected component is advised.
CVE-2026-82677 is a medium severity vulnerability in valkey-io valkey version 9.1.0. It involves a double free issue in the moduleTimerHandler function of the Module Timer Subsystem, which can be triggered remotely. Exploit code has been publicly disclosed. A patch identified by commit b349fe2821e3998534b1454c1b64a478daf8c6b7 is recommended for remediation.
CVE-2026-82631 is a use-after-free vulnerability in valkey-io valkey version 9.1.0, specifically in the handleClientsBlockedOnKey function within the Blocked-on-keys subsystem. The flaw can be exploited remotely but requires high attack complexity and privileges. A patch identified by commit b2fb0e13f5b4c8c2fb63dcfc2c37a067a0d6d20b is available to address this issue. The vulnerability has a medium severity rating with a CVSS score of 2.1.
CVE-2026-63639 is a high-severity use-after-free vulnerability in the valkey distributed key-value database. It affects the RESTORE command prior to versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1. The flaw arises when a malformed RDB stream payload assigns a single Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, leading to a use-after-free condition if one consumer is deleted while others still reference the shared NACK. This can potentially allow remote code execution. The issue is fixed in the specified patched versions.
Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's tlsProcessPendingData function iterates pending_list while an authenticated client can trigger CLIENT KILL, causing connTLSClose to delete the iterator's cached next node and producing a use-after-free that can crash the server or potentially allow remote code execution when TLS is enabled. This issue is fixed in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1.
Valkey-Bloom is a Rust based Valkey module which brings a Bloom Filter (Module) data type into the Valkey distributed key-value database. Prior to commit a68614b6e3845777d383b3a513cedcc08b3b7ccd, a specially crafted `RESTORE` command can cause Valkey to hit an assertion, causes the server to shutdown. Valkey modules are required to handle errors in RDB parsing by using `VALKEYMODULE_OPTIONS_HANDLE_IO_ERRORS` flag. If this flag is not set, errors encountered during parsing result in a system assertion which shuts down the system. Even though the Valkey-bloom module correctly handled the parsing, it did not originally set the flag. Commit a68614b6e3845777d383b3a513cedcc08b3b7ccd contains a patch. One may mitigate this defect by disabling the `RESTORE` command if it is unused by one's application.
Valkey is a distributed key-value database. Starting in version 9.0.0 and prior to version 9.0.3, a malicious actor with network access to Valkey can cause the system to abort by triggering an assertion. When processing incoming requests, the Valkey system does not properly reset the networking state after processing an empty request. A malicious actor can then send a request that the server incorrectly identifies as breaking server side invariants, which results in the server shutting down. Version 9.0.3 fixes the issue. As an additional mitigation, properly isolate Valkey deployments so that only trusted users have access.
Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious actor with access to the Valkey clusterbus port can send an invalid packet that may cause an out bound read, which might result in the system crashing. The Valkey clusterbus packet processing code does not validate that a clusterbus ping extension packet is located within buffer of the clusterbus packet before attempting to read it. Versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12 fix the issue. As an additional mitigation, don't expose the cluster bus connection directly to end users, and protect the connection with its own network ACLs.
Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious user can use scripting commands to inject arbitrary information into the response stream for the given client, potentially corrupting or returning tampered data to other users on the same connection. The error handling code for lua scripts does not properly handle null characters. Versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12 fix the issue.