Description
A vulnerability was detected in valkey-io valkey up to 9.5.4/9.1.0. Affected by this vulnerability is the function createSlotImportJob of the file src/cluster_migrateslots.c of the component Slot Migration. The manipulation of the argument job_name results in out-of-bounds read. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version 9.0.5 and 9.1.1 addresses this issue. The patch is identified as f4dc3ca09eb650c2fe14060090a41c524eca803f. Upgrading the affected component is advised.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| valkey-io | valkey | 9.0, 9.1.0, 9.5.0, 9.5.1, 9.5.2, 9.5.3, 9.5.4 | 9.0.5 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | valkey | 9.1.2-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | valkey | 9.0.4-0ubuntu0.2 | USN-8771-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | valkey | 7.2.13+dfsg1-0ubuntu0.1+esm1 | USN-8771-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | valkey +5 | 9.0.6-0.1.hum1 | RHSA-2026:61884 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | valkey | 9.1.2-2.1 | openSUSE-SU-2026:11809-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | valkey +1 | 9.0.6-1.amzn2023.0.1 | ALAS2023-2026-3091 |
Advisories 4
- RHSA-2026:61884 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- ALAS2023-2026-3091 Moderate: valkey security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Sep 28, 2026
- openSUSE-SU-2026:11809-1 valkey-9.1.2-2.1 on GA media SUSE / openSUSE Security Updates · Sep 18, 2026
- USN-8771-1 valkey vulnerabilities Ubuntu Security Notices (USN) · Sep 17, 2026
References
- VDB-398707 | valkey-io valkey Slot Migration cluster_migrateslots.c createSlotImportJob out-of-bounds vdb-entry technical-description
- VDB-398707 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- CVE-2026-85522 | CVE Analysis and Report third-party-advisory
- Submit #895119 | Valkey Project Valkey 9.1.0 Out-of-bounds Read third-party-advisory
- https://github.com/valkey-io/valkey/issues/4207 exploit issue-tracking
- https://github.com/valkey-io/valkey/pull/4210 issue-tracking patch
- https://github.com/valkey-io/valkey/commit/f4dc3ca09eb650c2fe14060090a41c524eca803f patch
- https://github.com/valkey-io/valkey/releases/tag/9.1.1 patch
- https://github.com/valkey-io/valkey/ product