Executive brief
Valkey is an open-source distributed key-value database used for caching and real-time workloads. A flaw in its cluster mode processing allows an attacker with write access to the data directory to craft a malicious RDB file that triggers an out-of-bounds memory read at startup, potentially causing the server to crash or exposing sensitive data in memory.
Technical details
The vulnerability is an out-of-bounds read in the kvstoreGetHashtable function (src/kvstore.c) triggered by manipulation of the didx argument. The flaw requires cluster mode to be enabled, attacker-controlled write access to the data directory (via a crafted RDB file, replication feed, or stored RDB), and occurs at server boot time rather than via remote network authentication. An attacker can cause a denial of service by crashing the server during initialization or potentially leak sensitive data from memory. The issue has been assigned CVE-2026-86227 with a CVSS score of 3.1 (low severity). A patch is available with commit hash 4691888e7fab3df128f0bde5750c9fde2ae552fa.
Affected products
- Valkey Valkey up to 9.0.5 and 9.1.1
Timeline
- 2026-09-06: disclosed