CVE-2026-86227
published 2026-09-06CVE-2026-86227: A weakness has been identified in valkey-io valkey up to 9.0.5/9.1.1. This affects the function kvstoreGetHashtable of the file src/kvstore.c. This…
PriorityP416low3.1CVSS 3.1
AVNACHPRLUINSUCNINAL
EPSS
0.52%
43.6th percentile
A weakness has been identified in valkey-io valkey up to 9.0.5/9.1.1. This affects the function kvstoreGetHashtable of the file src/kvstore.c. This manipulation of the argument didx causes out-of-bounds read. It is possible to initiate the attack remotely. The attack is considered to have high complexity. It is indicated that the exploitability is difficult. The exploit has been made available to the public and could be used for attacks. Patch name: 4691888e7fab3df128f0bde5750c9fde2ae552fa. To fix this issue, it is recommended to deploy a patch. Exploitation requires cluster mode plus attacker-controlled dump.rdb at startup (data-dir write access, replication feed, or a stored crafted RDB) - an attacker-position DoS at boot, not network pre-auth. The issue report was closed stating it "is worth fixing for the sake of memory safety… but I don't think it meets our bar for a security disclosure."
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| valkey-io | valkey | — | — |
| valkey-io | valkey | — | — |
| valkey-io | valkey | — | — |
| valkey-io | valkey | — | — |
| valkey-io | valkey | — | — |
| valkey-io | valkey | — | — |
| valkey-io | valkey | — | — |
| valkey-io | valkey | — | — |
| valkey-io | valkey | — | — |
CVSS provenance
nvdv3.13.1LOWCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
nvdv4.01.3LOWCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.02.1LOWAV:N/AC:H/Au:S/C:N/I:N/A:P
vendor_redhat3.1LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A weakness has been identified in valkey-io valkey up to 9.0.5/9.1.1.
ghsa_unreviewed·2026-09-07
CVE-2026-86227 [LOW] CWE-119 A weakness has been identified in valkey-io valkey up to 9.0.5/9.1.1.
A weakness has been identified in valkey-io valkey up to 9.0.5/9.1.1. This affects the function kvstoreGetHashtable of the file src/kvstore.c. This manipulation of the argument didx causes out-of-bounds read. It is possible to initiate the attack remotely. The attack is considered to have high complexity. It is indicated that the exploitability is difficult. The exploit has been made available to the public and could be used for attacks. Patch name: 4691888e7fab3df128f0bde5750c9fde2ae552fa. To fix this issue, it is recommended to deploy a patch. Exploitation requires cluster mode plus attacker-controlled dump.rdb at startup (data-dir write access, replication feed, or a stored crafted RDB) - an attacker-position DoS at boot, not network pre-auth. The issue report was closed stating it "is
VulDB
valkey-io valkey up to 9.0.5/9.1.1 src/kvstore.c kvstoreGetHashtable didx out-of-bounds (Issue 4222 / EUVD-2026-72176)
vuldb·2026-09-07·CVSS 3.1
CVE-2026-86227 [LOW] valkey-io valkey up to 9.0.5/9.1.1 src/kvstore.c kvstoreGetHashtable didx out-of-bounds (Issue 4222 / EUVD-2026-72176)
A vulnerability, which was classified as problematic, has been found in valkey-io valkey up to 9.0.5/9.1.1. This affects the function kvstoreGetHashtable of the file src/kvstore.c. This manipulation of the argument didx causes out-of-bounds read.
The identification of this vulnerability is CVE-2026-86227. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.
To fix this issue, it is recommended to deploy a patch.
Exploitation requires cluster mode plus attacker-controlled dump.rdb at startup (data-dir write access, replication feed, or a stored crafted RDB) - an attacker-position DoS at boot, not network pre-auth. The issue report was closed stating it "is worth fixing for the sake of memory safety… but I don't think it meets our bar for a security
Red Hat
valkey: Valkey: Denial of Service due to out-of-bounds read
vendor_redhat·2026-09-06·CVSS 3.1
CVE-2026-86227 [LOW] CWE-125 valkey: Valkey: Denial of Service due to out-of-bounds read
valkey: Valkey: Denial of Service due to out-of-bounds read
A weakness has been identified in valkey-io valkey up to 9.0.5/9.1.1. This affects the function kvstoreGetHashtable of the file src/kvstore.c. This manipulation of the argument didx causes out-of-bounds read. It is possible to initiate the attack remotely. The attack is considered to have high complexity. It is indicated that the exploitability is difficult. The exploit has been made available to the public and could be used for attacks. Patch name: 4691888e7fab3df128f0bde5750c9fde2ae552fa. To fix this issue, it is recommended to deploy a patch. Exploitation requires cluster mode plus attacker-controlled dump.rdb at startup (data-dir write access, replication feed, or a stored crafted RDB) - an attacker-position DoS at boot, not
No detection rules found.
No public exploits indexed.
https://github.com/user-attachments/files/30195539/RDB.ziphttps://github.com/valkey-io/valkey/https://github.com/valkey-io/valkey/commit/4691888e7fab3df128f0bde5750c9fde2ae552fahttps://github.com/valkey-io/valkey/issues/4222https://github.com/valkey-io/valkey/pull/4229https://vuldb.com/cve/CVE-2026-86227https://vuldb.com/submit/897659https://vuldb.com/vuln/399380https://vuldb.com/vuln/399380/cti
2026-09-06
Published