Description
A weakness has been identified in valkey-io valkey up to 9.0.5/9.1.1. This affects the function kvstoreGetHashtable of the file src/kvstore.c. This manipulation of the argument didx causes out-of-bounds read. It is possible to initiate the attack remotely. The attack is considered to have high complexity. It is indicated that the exploitability is difficult. The exploit has been made available to the public and could be used for attacks. Patch name: 4691888e7fab3df128f0bde5750c9fde2ae552fa. To fix this issue, it is recommended to deploy a patch. Exploitation requires cluster mode plus attacker-controlled dump.rdb at startup (data-dir write access, replication feed, or a stored crafted RDB) - an attacker-position DoS at boot, not network pre-auth. The issue report was closed stating it "is worth fixing for the sake of memory safety… but I don't think it meets our bar for a security disclosure."
Published: 2026-09-06
Score: 2.3 Low
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A weakness in valkey-io's Valkey database up to versions 9.0.5 and 9.1.1 allows an attacker to manipulate the didx argument of the kvstoreGetHashtable function, resulting in an out‑of‑bounds read that can cause a denial‑of‑service during the server boot process if a crafted RDB file is loaded.

Affected Systems

The affected product is valkey-io's Valkey database. Versions up to and including 9.0.5 and 9.1.1 are impacted.

Risk and Exploitability

The CVSS score of 2.3 indicates low severity. Exploitation requires cluster mode and an attacker‑controlled dump.rdb file present at startup, so the conditions are highly specific and do not permit a remote unauthenticated network attack before boot. The EPSS score is not available and the vulnerability is not listed in KEV, suggesting limited public exploitation activity. Nevertheless, because the flaw can halt service availability, it merits timely attention, especially in environments that use cluster mode.

Generated by OpenCVE AI on September 6, 2026 at 23:51 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor‑provided patch referenced by commit 4691888e7fab3df128f0bde5750c9fde2ae552fa to fix the out‑of‑bounds read in kvstoreGetHashtable.
  • If the patch cannot be applied immediately, disable cluster mode or remove cluster support until a secure build is available, ensuring that a crafted dump.rdb cannot be processed during startup.
  • Enforce strict access controls on the data directory and any replication feeds so that only trusted processes can write or supply a dump.rdb file.
  • Monitor for repeated out‑of‑bounds access attempts or startup failures, and consider raising an alert if the service terminates during boot.

Generated by OpenCVE AI on September 6, 2026 at 23:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 06 Sep 2026 22:30:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in valkey-io valkey up to 9.0.5/9.1.1. This affects the function kvstoreGetHashtable of the file src/kvstore.c. This manipulation of the argument didx causes out-of-bounds read. It is possible to initiate the attack remotely. The attack is considered to have high complexity. It is indicated that the exploitability is difficult. The exploit has been made available to the public and could be used for attacks. Patch name: 4691888e7fab3df128f0bde5750c9fde2ae552fa. To fix this issue, it is recommended to deploy a patch. Exploitation requires cluster mode plus attacker-controlled dump.rdb at startup (data-dir write access, replication feed, or a stored crafted RDB) - an attacker-position DoS at boot, not network pre-auth. The issue report was closed stating it "is worth fixing for the sake of memory safety… but I don't think it meets our bar for a security disclosure."
Title valkey-io valkey kvstore.c kvstoreGetHashtable out-of-bounds
First Time appeared Valkey-io
Valkey-io valkey
Weaknesses CWE-119
CWE-125
CPEs cpe:2.3:a:valkey-io:valkey:*:*:*:*:*:*:*:*
Vendors & Products Valkey-io
Valkey-io valkey
References
Metrics cvssV2_0

{'score': 2.1, 'vector': 'AV:N/AC:H/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 3.1, 'vector': 'CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 3.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 2.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Valkey-io Valkey
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-06T22:15:13.103Z

Reserved: 2026-09-06T04:07:49.539Z

Link: CVE-2026-86227

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-06T23:17:38.150

Modified: 2026-09-06T23:17:38.150

Link: CVE-2026-86227

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-07T00:00:06Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-125

    Out-of-bounds Read