CVE-2026-85522 - Vulnerability Details

- valkey-io valkey Slot Migration cluster_migrateslots.c createSlotImportJob out-of-bounds

Description

A vulnerability was detected in valkey-io valkey up to 9.5.4/9.1.0. Affected by this vulnerability is the function createSlotImportJob of the file src/cluster_migrateslots.c of the component Slot Migration. The manipulation of the argument job_name results in out-of-bounds read. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version 9.0.5 and 9.1.1 addresses this issue. The patch is identified as f4dc3ca09eb650c2fe14060090a41c524eca803f. Upgrading the affected component is advised.

Published: 2026-09-04

Score: 6.9 Medium

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Impact

A buffer-related flaw exists in the createSlotImportJob function within Valkey's Slot Migration module. Manipulating the job_name argument can trigger an out-of-bounds read, exposing sensitive data to an attacker with network access. The defect allows exploitation from a remote source, meaning that any system exposed to untrusted traffic could be compromised. The vulnerability is publicly known and the associated patch is available.

Affected Systems

The flaw affects Valkey releases up to 9.5.4 on the 9.5.x line and up to 9.1.0 on the 9.1.x line. All other versions are considered unaffected.

Risk and Exploitability

The CVSS score of 6.9 reflects moderate severity; the EPSS score is not available, and the issue is not listed in the CISA KEV catalog, but the publicly available exploit means that attackers can readily target vulnerable systems. Remote exploitation is possible, so the risk is real for exposed deployments. Patching to 9.0.5 or 9.1.1 resolves the problem.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

valkey-io

valkey

affected

Version	Status	Constraints
`9.0`	affected	—
`9.1.0`	affected	—
`9.5.0`	affected	—
`9.5.1`	affected	—
`9.5.2`	affected	—
`9.5.3`	affected	—
`9.5.4`	affected	—
`9.0.5`	unaffected	—
`9.1.1`	unaffected	—

No data.

No data available yet.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade Valkey to at least version 9.0.5 on the 9.5.x line or 9.1.1 on the 9.1.x line, which includes the f4dc3ca patch
Restrict external network access to the Valkey instance using firewall rules until the patch is deployed
Review Valkey release notes and apply any future security patches promptly

Generated by OpenCVE AI on September 4, 2026 at 16:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

This CVE is not in the KEV list.

No EPSS score available.

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/valkey-io/valkey/
https://github.com/valkey-io/valkey/commit/f4dc3ca09eb650c2fe14060090a41c524eca803f
https://github.com/valkey-io/valkey/issues/4207
https://github.com/valkey-io/valkey/pull/4210
https://github.com/valkey-io/valkey/releases/tag/9.1.1
https://vuldb.com/cve/CVE-2026-85522
https://vuldb.com/submit/895119
https://vuldb.com/vuln/398707
https://vuldb.com/vuln/398707/cti

History

Fri, 04 Sep 2026 16:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Fri, 04 Sep 2026 14:00:00 +0000

Type	Values Removed	Values Added
Description		A vulnerability was detected in valkey-io valkey up to 9.5.4/9.1.0. Affected by this vulnerability is the function createSlotImportJob of the file src/cluster_migrateslots.c of the component Slot Migration. The manipulation of the argument job_name results in out-of-bounds read. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version 9.0.5 and 9.1.1 addresses this issue. The patch is identified as f4dc3ca09eb650c2fe14060090a41c524eca803f. Upgrading the affected component is advised.
Title		valkey-io valkey Slot Migration cluster_migrateslots.c createSlotImportJob out-of-bounds
First Time appeared		Valkey-io Valkey-io valkey
Weaknesses		CWE-119 CWE-125
CPEs		cpe:2.3:a:valkey-io:valkey::::::::
Vendors & Products		Valkey-io Valkey-io valkey
References		https://github.com/valkey-io/valkey/ https://github.com/valkey-io/valkey/commit/f4dc3ca09eb650c2fe14060090a41c524eca803f https://github.com/valkey-io/valkey/issues/4207 https://github.com/valkey-io/valkey/pull/4210 https://github.com/valkey-io/valkey/releases/tag/9.1.1 https://vuldb.com/cve/CVE-2026-85522 https://vuldb.com/submit/895119 https://vuldb.com/vuln/398707 https://vuldb.com/vuln/398707/cti
Metrics		cvssV2_0 `{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:OF/RC:C'}` cvssV3_0 `{'score': 5.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C'}` cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C'}` cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P'}`

Subscriptions

Valkey-io Valkey

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-09-04T13:45:15.397Z

Updated: 2026-09-04T16:02:14.218Z

Reserved: 2026-09-04T07:57:10.252Z

Link: CVE-2026-85522

Vulnrichment

Updated: 2026-09-04T16:02:07.276Z

NVD

Status : Received

Published: 2026-09-04T14:17:22.807

Modified: 2026-09-04T16:18:18.310

Link: CVE-2026-85522

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-04T16:30:06Z

Weaknesses

CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-125
Out-of-bounds Read

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

Exploitation poc

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object