Executive brief
Valkey is an open-source, distributed key-value database used for caching and real-time workloads. A vulnerability in the slot migration feature allows a malicious RDB (snapshot) file with a crafted job name to trigger an out-of-bounds memory read during server startup, potentially allowing remote attackers to read sensitive data or cause a denial of service.
Technical details
The vulnerability is an out-of-bounds read in the `createSlotImportJob()` function within `src/cluster_migrateslots.c`. The root cause is that `clusterRDBLoadSlotImport()` accepts a variable-length `job_name` from an RDB file, but `createSlotImportJob()` always copies exactly `CLUSTER_NAMELEN` (40) bytes via `memcpy`, without validating the actual length. A crafted RDB file with a job_name shorter than 40 bytes triggers a heap out-of-bounds read during server startup. The attack vector is network-accessible if an attacker can provide a malicious RDB file (e.g., via replication or file upload). The fix validates that `job_name` length matches `CLUSTER_NAMELEN` exactly, matching the existing command-path check. Patches are available in versions 9.0.5 and 9.1.1 (commit f4dc3ca09eb650c2fe14060090a41c524eca803f).
Affected products
- valkey-io Valkey up to 9.5.4 and 9.1.0
Timeline
- 2026-09-04: disclosed: CVE-2026-85522 published
- 2026-07-21: patched: Fix committed (f4dc3ca09eb650c2fe14060090a41c524eca803f)
- 2026-07-22: other: Patch authored