CVE-2026-27623
Assertion Failure in Valkey Networking Causes Denial of Service
Publication date: 2026-02-23
Last updated on: 2026-02-25
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| lfprojects | valkey | From 9.0.0 (inc) to 9.0.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-20 | The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-27623 is a high-severity denial-of-service (DoS) vulnerability in the Valkey-server package versions 9.0.0 through 9.0.2. It occurs because the server does not properly reset its networking state after processing an empty request. A malicious actor with network access can send a specially crafted malformed request that causes the server to violate internal invariants, triggering an assertion failure and causing the server to abort unexpectedly.
This vulnerability requires no privileges or user interaction and has low complexity to exploit. It is fixed in version 9.0.3.
How can this vulnerability impact me? :
This vulnerability can cause the Valkey-server to unexpectedly shut down, resulting in a denial of service. This means that legitimate users will be unable to access the database while the server is down, potentially disrupting applications and services that rely on it.
Since the attack requires only network access and no privileges, it can be executed by any attacker who can reach the server, making it a significant availability risk.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for unexpected server crashes or aborts in Valkey-server versions 9.0.0 through 9.0.2 when processing network requests.
Since the issue is triggered by malformed RESP (Redis Serialization Protocol) requests causing assertion failures, one way to detect attempts is to capture and analyze network traffic for unusual or malformed RESP requests targeting the Valkey-server.
Specific commands to detect this vulnerability are not provided in the available resources.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade Valkey-server to version 9.0.3 or later, where this vulnerability is fixed.
Additionally, isolate Valkey deployments so that only trusted users have network access to the server, reducing the risk of exploitation.