CVE-2026-21863 — Out-of-bounds Read in Valkey

CWE-125 — Out-of-bounds Read10 documents7 sources
Severity
7.5HIGHNVD
OSV7.1
EPSS
0.0%
top 94.91%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
Valkey-io ValkeyLfprojects ValkeyDebian Redict+3 more
Timeline
PublishedFeb 23
Latest updateMar 18

Description

Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious actor with access to the Valkey clusterbus port can send an invalid packet that may cause an out bound read, which might result in the system crashing. The Valkey clusterbus packet processing code does not validate that a clusterbus ping extension packet is located within buffer of the clusterbus packet before attempting to read it. Versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12 fix the issue. As…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages8 packages

▶debiandebian/valkey< valkey 8.1.4+dfsg1-2 (forky)
▶CVEListV5valkey-io/valkey< 7.2.12+3
▶NVDlfprojects/valkey8.0.0 — 8.0.7+3
▶Debianlfprojects/valkey< 8.1.1+dfsg1-3+deb13u2+1
▶Ubuntulfprojects/valkey< 7.2.12+dfsg1-0ubuntu0.1+1

🔴Vulnerability Details

2
OSV
valkey vulnerabilities↗2026-03-18
▶
OSV
CVE-2026-21863: Valkey is a distributed key-value database↗2026-02-23
▶

📋Vendor Advisories

4
Ubuntu
Valkey vulnerabilities↗2026-03-18
▶
Red Hat
valkey: Valkey: Denial of Service via invalid clusterbus packet↗2026-02-23
▶
Microsoft
Malformed Valkey Cluster bus message can lead to Remote DoS↗2026-02-10
▶
Debian
CVE-2026-21863: redict - Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0....↗2026
▶

🕵️Threat Intelligence

3
Wiz
CVE-2026-27623 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
Wiz
CVE-2026-21863 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
Wiz
CVE-2025-67733 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
CVE-2026-21863 — Out-of-bounds Read in Valkey-io Valkey | cvebase