Executive brief
Valkey is a high-performance database used for storing and retrieving data quickly. A security flaw allows an attacker to crash the database server by sending a specifically formatted network request. This results in a service outage, making the database and any applications relying on it unavailable until it is restarted.
Technical details
A reachable assertion vulnerability (CWE-617) exists in Valkey versions 9.0.0 through 9.0.2. The root cause is a failure to properly reset the networking state after processing an empty RESP (Redis Serialization Protocol) request. An unauthenticated attacker with network access can exploit this by sending a subsequent malformed request that triggers a server-side invariant check, causing the process to abort. This results in a complete denial of service. The issue is resolved in Valkey version 9.0.3. Red Hat reports that their Enterprise Linux 9 and 10 implementations are currently unaffected.
Affected products
- Valkey-io Valkey >= 9.0.0, < 9.0.3
- Red Hat Red Hat Enterprise Linux 9 unaffected
- Red Hat Red Hat Enterprise Linux 10 unaffected
Timeline
- 2026-02-23: disclosed
- 2026-02-23: advisory
- 2026-02-23: patched: Fixed in version 9.0.3