Log in Start free

Vulnerability · Published Sep 4, 2026 · Assigned by VulDB

CVE-2026-85522valkey-io valkey Slot Migration cluster_migrateslots.c createSlotImportJob out-of-bounds

Medium 5.3

In plain English

A medium-severity out-of-bounds read in valkey from valkey-io. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.9%top 41.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was detected in valkey-io valkey up to 9.5.4/9.1.0. Affected by this vulnerability is the function createSlotImportJob of the file src/cluster_migrateslots.c of the component Slot Migration. The manipulation of the argument job_name results in out-of-bounds read. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version 9.0.5 and 9.1.1 addresses this issue. The patch is identified as f4dc3ca09eb650c2fe14060090a41c524eca803f. Upgrading the affected component is advised.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:14valkey9.1.2-1DEBIAN-CVE-2026-85522
Ubuntu:26.04:LTSvalkey9.0.4-0ubuntu0.2UBUNTU-CVE-2026-85522
Ubuntu:26.04:LTSvalkey9.0.4-0ubuntu0.2USN-8771-1

Affected products (as reported)

VendorProductVersions
valkey-io valkey 9.09.1.09.5.09.5.19.5.29.5.39.5.4

Weakness: CWE-125, CWE-119 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C

References