# CVE-2016-9052: Aerospike Database Server stack overflow in as_sindex__simatch_by_iname

Source: https://junglewise.ai/threats/cve-2016-9052-aerospike-database-server-stack-overflow-in-as-sindex-simatch-by  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-26. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2016-9052 · Severity: critical · CVSS 9.8 · Published 2017-01-26

Aerospike Database Server, a high-performance NoSQL database used for large-scale web applications, contains a critical security flaw in its data querying component. An unauthenticated attacker can exploit this by sending a specially crafted network packet to the database server. Successful exploitation could allow the attacker to take complete control of the server, potentially leading to data theft, service disruption, or unauthorized access to the underlying infrastructure.

Technologies: [Aerospike Database Server](https://junglewise.ai/threats/technologies/database-server). Vendors: [Aerospike](https://junglewise.ai/threats/vendors/aerospike).

## Quick answers

**Is CVE-2016-9052 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2016-9052 being exploited in the wild.

**How severe is CVE-2016-9052?** Critical severity, with a CVSS score of 9.8, published 26 January 2017.

**Which products and versions are affected?** Aerospike Aerospike Database Server 3.10.0.3.

**Is there a fix for CVE-2016-9052?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2016-9052 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2016-9052?** Check whether you run Aerospike Database Server. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack-based buffer overflow vulnerability exists in Aerospike Database Server 3.10.0.3 within the secondary index matching logic. The flaw is located in the `as_sindex__simatch_by_iname` function, which is reachable during the processing of multi-record query transactions. When the server receives a packet with the `PROTO_TYPE_AS_MSG` protocol type and the `AS_MSG_FIELD_BIT_INDEX_RANGE` field set, it triggers the query setup path. An attacker can trigger the overflow by providing a specially crafted index name or related field in the query packet. This vulnerability is exploitable over the network without authentication, allowing for remote code execution (RCE) with the privileges of the database process.

## Affected products

- Aerospike Aerospike Database Server 3.10.0.3

## Timeline

- 2016-11-20: disclosed: Vulnerability reported to vendor by Cisco Talos
- 2017-01-09: advisory: Public advisory released by Cisco Talos
- 2017-01-26: advisory: NVD publication date

## References

- [http://www.securityfocus.com/bid/95419](http://www.securityfocus.com/bid/95419)
- [http://www.talosintelligence.com/reports/TALOS-2016-0266/](http://www.talosintelligence.com/reports/TALOS-2016-0266/)

## Related threats

- [Aerospike Database Server stack overflow in querying functionality](https://junglewise.ai/threats/cve-2016-9054-aerospike-database-server-stack-overflow-in-querying-functionality)
- [Aerospike Database Server out-of-bounds read in message parsing](https://junglewise.ai/threats/cve-2016-9050-aerospike-database-server-out-of-bounds-read-in-message-parsing)