Is CVE-2026-86227 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86227 being exploited in the wild.

How severe is CVE-2026-86227?

Low severity, with a CVSS score of 3.1, published 6 September 2026.

Which products and versions are affected?

Valkey Valkey up to 9.0.5 and 9.1.1.

Is there a fix for CVE-2026-86227?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-86227 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-86227?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86227: Valkey out-of-bounds read in kvstoreGetHashtable

CVE-2026-86227 · Severity: low · CVSS 3.1 · Published 2026-09-06

Valkey is an open-source distributed key-value database used for caching and real-time workloads. A flaw in its cluster mode processing allows an attacker with write access to the data directory to craft a malicious RDB file that triggers an out-of-bounds memory read at startup, potentially causing the server to crash or exposing sensitive data in memory.

Quick answers

Is CVE-2026-86227 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86227 being exploited in the wild.
How severe is CVE-2026-86227?: Low severity, with a CVSS score of 3.1, published 6 September 2026.
Which products and versions are affected?: Valkey Valkey up to 9.0.5 and 9.1.1.
Is there a fix for CVE-2026-86227?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-86227 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-86227?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an out-of-bounds read in the kvstoreGetHashtable function (src/kvstore.c) triggered by manipulation of the didx argument. The flaw requires cluster mode to be enabled, attacker-controlled write access to the data directory (via a crafted RDB file, replication feed, or stored RDB), and occurs at server boot time rather than via remote network authentication. An attacker can cause a denial of service by crashing the server during initialization or potentially leak sensitive data from memory. The issue has been assigned CVE-2026-86227 with a CVSS score of 3.1 (low severity). A patch is available with commit hash 4691888e7fab3df128f0bde5750c9fde2ae552fa.

Affected products

Valkey Valkey up to 9.0.5 and 9.1.1

Timeline

2026-09-06: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.