CVE-2026-85522
Received Received - Intake

Out-of-Bounds Read in Valkey Slot Migration

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: VulDB

Description
A vulnerability was detected in valkey-io valkey up to 9.5.4/9.1.0. Affected by this vulnerability is the function createSlotImportJob of the file src/cluster_migrateslots.c of the component Slot Migration. The manipulation of the argument job_name results in out-of-bounds read. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version 9.0.5 and 9.1.1 addresses this issue. The patch is identified as f4dc3ca09eb650c2fe14060090a41c524eca803f. Upgrading the affected component is advised.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-85522
EUVD
EUVD-2026-71102

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
valkey-io valkey to 9.5.4 (exc)
valkey-io valkey to 9.1.1 (inc)
valkey-io valkey to 9.0.5 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-85522 is a server-side memory-safety vulnerability in Valkey 9.1.0 that allows a heap out-of-bounds read during startup when loading a crafted RDB file. The issue occurs in the RDB loading path for the RDB_OPCODE_SLOT_IMPORT opcode when cluster mode is enabled.

Detection Guidance

To detect this vulnerability, check if your Valkey server is running a vulnerable version (up to 9.5.4/9.1.0). Inspect RDB files for malformed slot import job names using valkey-check-rdb tool. Look for crashes during startup with crafted RDB files containing short job names.

Impact Analysis

This vulnerability can cause a denial-of-service condition by crashing the server during startup if a malicious RDB file is loaded. It does not require additional modules or internal function invocations to exploit.

Compliance Impact

This vulnerability causes a denial-of-service condition by crashing the Valkey server during startup when processing a maliciously crafted RDB file. While it does not directly expose data, service disruption could impact systems handling sensitive data, potentially violating availability requirements in GDPR or HIPAA. However, the vulnerability does not lead to data breaches or unauthorized access.

Mitigation Strategies

Upgrade Valkey to version 9.0.5 or 9.1.1 or later. Apply the patch f4dc3ca09eb650c2fe14060090a41c524eca803f. Validate all RDB files before loading using valkey-check-rdb to ensure job names are exactly 40 bytes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85522. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart