CVE-2026-85522 in valkey
Summary
by MITRE • 09/04/2026
A vulnerability was detected in valkey-io valkey up to 9.5.4/9.1.0. Affected by this vulnerability is the function createSlotImportJob of the file src/cluster_migrateslots.c of the component Slot Migration. The manipulation of the argument job_name results in out-of-bounds read. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version 9.0.5 and 9.1.1 addresses this issue. The patch is identified as f4dc3ca09eb650c2fe14060090a41c524eca803f. Upgrading the affected component is advised.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability identified in valkey-io valkey, specifically affecting versions up to 9.5.4 and 9.1.0, represents a critical security flaw within the cluster slot migration subsystem. This issue resides in the createSlotImportJob function located in the source file src/cluster_migrateslots.c. The core technical defect is an out-of-bounds read condition triggered by the manipulation of the job_name argument. In C-based systems like valkey, which are often used for high-performance data structures and caching, memory safety is paramount. An out-of-bounds read occurs when a program attempts to access memory locations that lie outside the boundaries of the intended buffer or array. This specific flaw allows an attacker who can control the job_name parameter during slot migration operations to cause the application to read from invalid memory addresses. Such behavior typically leads to information disclosure, where sensitive data residing in adjacent memory regions may be leaked to the attacker, and can potentially destabilize the server process if the accessed memory is unmapped or protected.
The operational impact of this vulnerability is significant due to its remote executability. Since valkey often operates as a network-facing service handling client requests, an unauthenticated or authenticated remote attacker could craft malicious slot migration commands that exploit this flaw. The fact that public exploits are available further elevates the risk profile, enabling less sophisticated actors to compromise system integrity and confidentiality. In a clustered environment, such vulnerabilities can be leveraged not only against individual nodes but potentially to disrupt cluster consensus or cause denial of service conditions by crashing worker processes. This undermines the high availability guarantees that valkey clusters are designed to provide, leading to potential data unavailability during critical periods.
From a classification perspective, this vulnerability aligns with CWE-125, which defines out-of-bounds read vulnerabilities where software reads past the end or beginning of an intended buffer. In terms of attack vectors and techniques, this flaw facilitates reconnaissance and information gathering phases within the MITRE ATT&CK framework, specifically relating to Tactic TA0042: Resource Development or potentially early stages of exploitation leading to privilege escalation depending on the specific memory layout and subsequent actions taken by the attacker. The remote nature of the exploit maps directly to network-based attack vectors described in techniques such as Remote Services (TA0005), highlighting the necessity for strict input validation and bounds checking in all functions that process external inputs, particularly those involved in complex cluster operations like slot migration.
To mitigate this risk, immediate action is required to upgrade valkey instances to patched versions 9.0.5 or 9.1.1 and later. The specific patch addressing this issue is identified by the commit hash f4dc3ca09eb650c2fe14060090a41c524eca803f, which implements necessary bounds checks within the createSlotImportJob function to prevent access to invalid memory regions. Organizations should verify their current valkey version and apply these updates across all cluster nodes promptly. Additionally, implementing network-level controls such as firewalls or intrusion detection systems can help monitor for anomalous slot migration traffic patterns that might indicate exploitation attempts while patching is being deployed. Regular security audits of third-party dependencies and adherence to secure coding practices involving rigorous input validation are essential preventive measures against similar memory safety vulnerabilities in the future.