Skip to content
Fencer Vulns
low 3.1

CVE-2026-86227 json

valkey-io valkey kvstore.c kvstoreGetHashtable out-of-bounds

published 2026-09-06 2 mo ago modified 2026-09-09 2 mo ago also EUVD-2026-72176

cvss
3.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 44%
public exploits
0
none known

Summary

A weakness has been identified in valkey-io valkey up to 9.0.5/9.1.1. This affects the function kvstoreGetHashtable of the file src/kvstore.c. This manipulation of the argument didx causes out-of-bounds read. It is possible to initiate the attack remotely. The attack is considered to have high complexity. It is indicated that the exploitability is difficult. The exploit has been made available to the public and could be used for attacks. Patch name: 4691888e7fab3df128f0bde5750c9fde2ae552fa. To fix this issue, it is recommended to deploy a patch. Exploitation requires cluster mode plus attacker-controlled dump.rdb at startup (data-dir write access, replication feed, or a stored crafted RDB) - an attacker-position DoS at boot, not network pre-auth. The issue report was closed stating it "is worth fixing for the sake of memory safety… but I don't think it meets our bar for a security disclosure."

Patch / fix

  • valkey Debian 14 9.1.2-1

debian advisories DEBIAN-CVE-2026-86227

  • valkey hummingbird 1 9.0.6-0.1.hum1
  • valkey-rdma hummingbird 1 9.0.6-0.1.hum1
  • valkey-compat-redis hummingbird 1 9.0.6-0.1.hum1

red hat advisories RHSA-2026:61884

  • valkey openSUSE Tumbleweed 9.1.2-2.1

opensuse advisories openSUSE-SU-2026:11809-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-86227 updated cvss 3.1

valkey: Valkey: Denial of Service due to out-of-bounds read

  • Red Hat Hardened Images valkey 9.0.6-0.1.hum1, valkey-rdma 9.0.6-0.1.hum1, valkey-compat-redis 9.0.6-0.1.hum1
    fixed: vendor fix RHSA-2026:61884

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
2 mo ago

Exploit prediction

0.52% chance of exploitation in the next 30 days, higher than 44% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/user-attachments/files/30195539/RDB.zip referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 4.0 2.3 CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
CNA 3.1 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
CNA 3.0 3.1 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
CNA 2.0 2.1 AV:N/AC:H/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C
CNA 4.0 1.3 CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA 3.1 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
CNA 2.0 2.1 AV:N/AC:H/Au:S/C:N/I:N/A:P

Affected products

  • valkey-io valkey

Classification

Weakness
  • CWE-125 Out-of-bounds Read
  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.