Log in Start free

Vulnerability · Published Feb 23, 2026 · Assigned by GitHub_M

CVE-2026-27623Valkey has Pre-Authentication DOS from malformed RESP request

High 7.5

In plain English

A high-severity improper input validation in valkey from valkey-io. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.4%top 65.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Valkey is a distributed key-value database. Starting in version 9.0.0 and prior to version 9.0.3, a malicious actor with network access to Valkey can cause the system to abort by triggering an assertion. When processing incoming requests, the Valkey system does not properly reset the networking state after processing an empty request. A malicious actor can then send a request that the server incorrectly identifies as breaking server side invariants, which results in the server shutting down. Version 9.0.3 fixes the issue. As an additional mitigation, properly isolate Valkey deployments so that only trusted users have access.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.23valkey9.0.3-r0ALPINE-CVE-2026-27623
Alpine:v3.24valkey9.0.3-r0ALPINE-CVE-2026-27623
Ubuntu:24.04:LTSvalkeyno fix listedUBUNTU-CVE-2026-27623
Ubuntu:25.10valkeyno fix listedUBUNTU-CVE-2026-27623

Affected products (as reported)

VendorProductVersions
valkey-io valkey >= 9.0.0, < 9.0.3

Weakness: CWE-20, CWE-617 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References