CVE-2026-85522
valkey-io valkey Slot Migration cluster_migrateslots.c createSlotImportJob out-of-bounds
A vulnerability was detected in valkey-io valkey up to 9.5.4/9.1.0. Affected by this vulnerability is the function createSlotImportJob of the file src/cluster_migrateslots.c of the component Slot Migration. The manipulation of the argument job_name results in out-of-bounds read. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version 9.0.5 and 9.1.1 addresses this issue. The patch is identified as f4dc3ca09eb650c2fe14060090a41c524eca803f. Upgrading the affected component is advised.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
valkey-io valkey Slot Migration cluster_migrateslots.c createSlotImportJob out-of-bounds
A vulnerability was detected in valkey-io valkey up to 9.5.4/9.1.0. Affected by this vulnerability is the function createSlotImportJob of the file src/cluster_migrateslots.c of the component Slot Migration. The manipulation of the argument job_name results in out-of-bounds read. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version 9.0.5 and 9.1.1 addresses this issue. The patch is identified as f4dc3ca09eb650c2fe14060090a41c524eca803f. Upgrading the affected component is advised.
- Record
CVE-2026-85522- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C - CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C - CVSS 2.0
- 5.0
AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:OF/RC:C - Weakness
- CWE-125, CWE-119
- Updated
- 2026-11-02
EUVDEUVD-2026-71102
A vulnerability was detected in valkey-io valkey up to 9.5.4/9.1.0. Affected by this vulnerability is the function createSlotImportJob of the file src/cluster_migrateslots.c of the component Slot Migration. The manipulation of the argument job_name results in out-of-bounds read. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version 9.0.5 and 9.1.1 addresses this issue. The patch is identified as f4dc3ca09eb650c2fe14060090a41c524eca803f. Upgrading the affected component is advised.
- Record
EUVD-2026-71102- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-cmxq-3354-mw5w
A vulnerability was detected in valkey-io valkey up to 9.5.4/9.1.0. Affected by this...
A vulnerability was detected in valkey-io valkey up to 9.5.4/9.1.0. Affected by this vulnerability is the function createSlotImportJob of the file src/cluster_migrateslots.c of the component Slot Migration. The manipulation of the argument job_name results in out-of-bounds read. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version 9.0.5 and 9.1.1 addresses this issue. The patch is identified as f4dc3ca09eb650c2fe14060090a41c524eca803f. Upgrading the affected component is advised.
- Record
GHSA-cmxq-3354-mw5w- CVSS 4.0
- 5.5 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-119
- Updated
- 2026-11-02
NVD
A vulnerability was detected in valkey-io valkey up to 9.5.4/9.1.0. Affected by this vulnerability is the function createSlotImportJob of the file src/cluster_migrateslots.c of the component Slot Migration. The manipulation of the argument job_name results in out-of-bounds read. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version 9.0.5 and 9.1.1 addresses this issue. The patch is identified as f4dc3ca09eb650c2fe14060090a41c524eca803f. Upgrading the affected component is advised.
- Record
CVE-2026-85522- CVSS 4.0
- 5.5 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-119, CWE-125
- Updated
- 2026-11-02
OSVBELL-CVE-2026-85522
- Record
BELL-CVE-2026-85522- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSV
valkey-io valkey Slot Migration cluster_migrateslots.c createSlotImportJob out-of-bounds
A vulnerability was detected in valkey-io valkey up to 9.5.4/9.1.0. Affected by this vulnerability is the function createSlotImportJob of the file src/cluster_migrateslots.c of the component Slot Migration. The manipulation of the argument job_name results in out-of-bounds read. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version 9.0.5 and 9.1.1 addresses this issue. The patch is identified as f4dc3ca09eb650c2fe14060090a41c524eca803f. Upgrading the affected component is advised.
- Record
CVE-2026-85522- CVSS 4.0
- 5.5 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P - Weakness
- CWE-119, CWE-125
- Updated
- 2026-11-02
Show 5 moreShow less
OSVDEBIAN-CVE-2026-85522
A vulnerability was detected in valkey-io valkey up to 9.5.4/9.1.0. Affected by this vulnerability is the function createSlotImportJob of the file src/cluster_migrateslots.c of the component Slot Migration. The manipulation of the argument job_name results in out-of-bounds read. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version 9.0.5 and 9.1.1 addresses this issue. The patch is identified as f4dc3ca09eb650c2fe14060090a41c524eca803f. Upgrading the affected component is advised.
- Record
DEBIAN-CVE-2026-85522- CVSS 4.0
- 5.5 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
OSVRHSA-2026:61884
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:61884- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-85522
A vulnerability was detected in valkey-io valkey up to 9.5.4/9.1.0. Affected by this vulnerability is the function createSlotImportJob of the file src/cluster_migrateslots.c of the component Slot Migration. The manipulation of the argument job_name results in out-of-bounds read. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version 9.0.5 and 9.1.1 addresses this issue. The patch is identified as f4dc3ca09eb650c2fe14060090a41c524eca803f. Upgrading the affected component is advised.
- Record
UBUNTU-CVE-2026-85522- CVSS 4.0
- 5.5 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11809-1 No score
valkey-9.1.2-2.1 on GA media
These are all security issues fixed in the valkey-9.1.2-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11809-1- Updated
- 2026-11-02
OSVUSN-8771-1 No score
valkey vulnerabilities
Madelyn Olson discovered that Valkey incorrectly handled TLS connections under certain conditions. A remote attacker could possibly use this issue to cause Valkey to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-56684)
It was discovered that Valkey incorrectly handled certain stream RDB payloads when executing the RESTORE command. An authenticated remote attacker could possibly use this issue to cause Valkey to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-63639)
It was discovered that Valkey incorrectly handled cluster slot migration operations. A remote attacker could possibly use this issue to cause Valkey to crash, resulting in a denial of service. This issue was only addressed in Ubuntu 26.04 LTS. (CVE-2026-85522)
- Record
USN-8771-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
valkeyAlpaquita:stream |
9.0.3-r0 up to 9.0.6-r0 | 9.0.6-r0 |
valkeyDebian:14 |
before 9.1.2-1, plus listed versions 8.1.1+dfsg1-38.1.4+dfsg1-18.1.4+dfsg1-29.1.1-1 |
9.1.2-1 |
valkeyRed Hat:hummingbird:1 From an advisory covering 6 CVEs |
before 0:9.0.6-0.1.hum1 | 0:9.0.6-0.1.hum1 |
valkey-compat-redisRed Hat:hummingbird:1 From an advisory covering 6 CVEs |
before 0:9.0.6-0.1.hum1 | 0:9.0.6-0.1.hum1 |
valkey-compat-redis-develRed Hat:hummingbird:1 From an advisory covering 6 CVEs |
before 0:9.0.6-0.1.hum1 | 0:9.0.6-0.1.hum1 |
valkey-develRed Hat:hummingbird:1 From an advisory covering 6 CVEs |
before 0:9.0.6-0.1.hum1 | 0:9.0.6-0.1.hum1 |
valkey-docRed Hat:hummingbird:1 From an advisory covering 6 CVEs |
before 0:9.0.6-0.1.hum1 | 0:9.0.6-0.1.hum1 |
valkey-rdmaRed Hat:hummingbird:1 From an advisory covering 6 CVEs |
before 0:9.0.6-0.1.hum1 | 0:9.0.6-0.1.hum1 |
valkeyUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 7.2.5+dfsg1-2ubuntu4~24.04.17.2.7+dfsg1-0ubuntu0.24.04.17.2.8+dfsg1-0ubuntu0.24.04.17.2.8+dfsg1-0ubuntu0.24.04.27.2.8+dfsg1-0ubuntu0.24.04.3 Show 6 moreShow less7.2.10+dfsg1-0ubuntu0.17.2.11+dfsg1-0ubuntu0.17.2.11+dfsg1-0ubuntu0.27.2.12+dfsg1-0ubuntu0.17.2.13+dfsg1-0ubuntu0.17.2.13+dfsg1-0ubuntu0.1+esm1 |
None known |
valkeyUbuntu:26.04:LTS |
before 9.0.4-0ubuntu0.2, plus listed versions 8.1.3+dfsg1-0ubuntu28.1.4+dfsg1-0ubuntu19.0.2-0ubuntu19.0.3-0ubuntu19.0.3-0ubuntu29.0.4-0ubuntu0.1 |
9.0.4-0ubuntu0.2 |
valkeyUbuntu:Pro:24.04:LTS From an advisory covering 3 CVEs |
before 7.2.13+dfsg1-0ubuntu0.1+esm1, plus listed versions 7.2.5+dfsg1-2ubuntu4~24.04.17.2.7+dfsg1-0ubuntu0.24.04.17.2.8+dfsg1-0ubuntu0.24.04.17.2.8+dfsg1-0ubuntu0.24.04.27.2.8+dfsg1-0ubuntu0.24.04.3 Show 5 moreShow less7.2.10+dfsg1-0ubuntu0.17.2.11+dfsg1-0ubuntu0.17.2.11+dfsg1-0ubuntu0.27.2.12+dfsg1-0ubuntu0.17.2.13+dfsg1-0ubuntu0.1 |
7.2.13+dfsg1-0ubuntu0.1+esm1 |
valkeyUbuntu:26.04:LTS From an advisory covering 3 CVEs |
before 9.0.4-0ubuntu0.2, plus listed versions 8.1.3+dfsg1-0ubuntu28.1.4+dfsg1-0ubuntu19.0.2-0ubuntu19.0.3-0ubuntu19.0.3-0ubuntu29.0.4-0ubuntu0.1 |
9.0.4-0ubuntu0.2 |
valkeyopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 9.1.2-2.1 | 9.1.2-2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-85522 is a medium vulnerability (CVSS 6.9) in Valkey-io Valkey, published September 4, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.86%, the 58th percentile. Fixed in valkey 9.0.6-r0.
References
vuldb.com/vuln/398707
github.com/valkey-io/valkey/issues/4207
Show 79 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-85522
docs.bell-sw.com/security/cves/CVE-2026-85522
security-tracker.debian.org/tracker/CVE-2026-85522
access.redhat.com/errata/RHSA-2026:61884
images.redhat.com
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_61884.json
bugzilla.redhat.com/show_bug.cgi?id=2517907
cve.org/CVERecord?id=CVE-2026-56684
ubuntu.com/security/CVE-2026-85522
suse.com/security/cve/CVE-2026-85522