# CVE-2016-9054: Aerospike Database Server stack overflow in querying functionality

Source: https://junglewise.ai/threats/cve-2016-9054-aerospike-database-server-stack-overflow-in-querying-functionality  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-26. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2016-9054 · Severity: critical · CVSS 9.8 · Published 2017-01-26

Aerospike Database Server is a high-performance NoSQL database used for large-scale web applications. A critical vulnerability in its querying system allows an attacker to take full control of the server by sending a specially crafted network packet. This could lead to the theft of sensitive customer data, complete service disruption, or the use of the server as a foothold for further attacks within the corporate network.

Technologies: [Aerospike Database Server](https://junglewise.ai/threats/technologies/database-server). Vendors: [Aerospike](https://junglewise.ai/threats/vendors/aerospike).

## Quick answers

**Is CVE-2016-9054 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2016-9054 being exploited in the wild.

**How severe is CVE-2016-9054?** Critical severity, with a CVSS score of 9.8, published 26 January 2017.

**Which products and versions are affected?** Aerospike Database Server 3.10.0.3.

**Is there a fix for CVE-2016-9054?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2016-9054 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2016-9054?** Check whether you run Aerospike Database Server or Aerospike Database Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack-based buffer overflow exists in Aerospike Database Server 3.10.0.3 within the querying functionality. The vulnerability is located in the `as_sindex__simatch_list_by_set_binid` function, which is triggered during the processing of secondary index queries. When the server demarshals a transaction packet, it fails to properly validate the length of the string provided in the `AS_MSG_FIELD_TYPE_SET` field before copying it into a fixed-size stack buffer. An unauthenticated remote attacker can exploit this by sending a malicious packet to the database port, leading to arbitrary code execution with the privileges of the database process. This vulnerability was identified by Cisco Talos as TALOS-2016-0268.

## Affected products

- Aerospike Aerospike Database Server 3.10.0.3

## Timeline

- 2016-11-20: disclosed: Vulnerability reported to vendor by Cisco Talos
- 2017-01-09: advisory: Public advisory released by Cisco Talos
- 2017-01-26: advisory: NVD publication date

## References

- [http://www.securityfocus.com/bid/95421](http://www.securityfocus.com/bid/95421)
- [http://www.talosintelligence.com/reports/TALOS-2016-0268/](http://www.talosintelligence.com/reports/TALOS-2016-0268/)

## Related threats

- [Aerospike Database Server stack overflow in as_sindex__simatch_by_iname](https://junglewise.ai/threats/cve-2016-9052-aerospike-database-server-stack-overflow-in-as-sindex-simatch-by)
- [Aerospike Database Server out-of-bounds read in message parsing](https://junglewise.ai/threats/cve-2016-9050-aerospike-database-server-out-of-bounds-read-in-message-parsing)