CVE-2026-85522

EUVD-2026-71102
A vulnerability was detected in valkey-io valkey up to 9.5.4/9.1.0. Affected by this vulnerability is the function createSlotImportJob of the file src/cluster_migrateslots.c of the component Slot Migration. The manipulation of the argument job_name results in out-of-bounds read. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version 9.0.5 and 9.1.1 addresses this issue. The patch is identified as f4dc3ca09eb650c2fe14060090a41c524eca803f. Upgrading the affected component is advised.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 57.66%
Debian logo
Debian Releases
Debian Product
Codename
valkey
forky
9.1.2-1
fixed
sid
9.1.2-1
fixed
trixie
8.1.1+dfsg1-3+deb13u2
fixed
trixie (security)
8.1.1+dfsg1-3+deb13u2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
valkey
jammy
dne
noble
needed
resolute
Fixed 9.0.4-0ubuntu0.2
released
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
valkey
Amazon Linux 2023
0:9.0.6-1.amzn2023.0.1
fixed
valkey-debuginfo
Amazon Linux 2023
0:9.0.6-1.amzn2023.0.1
fixed
valkey-debugsource
Amazon Linux 2023
0:9.0.6-1.amzn2023.0.1
fixed
valkey-devel
Amazon Linux 2023
0:9.0.6-1.amzn2023.0.1
fixed
Common Weakness Enumeration
References
https://github.com/valkey-io/valkey/
https://github.com/valkey-io/valkey/commit/f4dc3ca09eb650c2fe14060090a41c524eca803f
https://github.com/valkey-io/valkey/issues/4207
https://github.com/valkey-io/valkey/pull/4210
https://github.com/valkey-io/valkey/releases/tag/9.1.1
https://vuldb.com/cve/CVE-2026-85522
https://vuldb.com/submit/895119
https://vuldb.com/vuln/398707
https://vuldb.com/vuln/398707/cti