What is the CVSS score of CVE-2026-27623?

CVE-2026-27623 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Valkey are affected by CVE-2026-27623?

A denial-of-service vulnerability in Valkey versions 9.0.0-9.0.2 allows remote attackers to crash the database service through a malicious network request, potentially disrupting applications and…. A patch is available.

How to fix or mitigate CVE-2026-27623?

Within 24 hours: Identify all systems running Valkey 9.0.0-9.0.2 and document their criticality and exposure. Within 7 days: Implement network segmentation to restrict Valkey access to trusted sources only, and subscribe to vendor security notifications. Within 30 days: Upgrade to Valkey 9.0.3 or later when available, or evaluate alternative solutions if upgrade timeline extends beyond organizational risk tolerance.

Valkey CVE-2026-27623

HIGH

Improper Input Validation (CWE-20)

2026-02-23 security-advisories@github.com

Valkey Denial Of Service

7.5

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SUSE

HIGH

qualitative

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (github).

CVSS VectorVendor: github

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch released

Apr 10, 2026 - 08:30 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 23, 2026 - 20:28 nvd

HIGH 7.5

DescriptionCVE.org

Valkey is a distributed key-value database. Starting in version 9.0.0 and prior to version 9.0.3, a malicious actor with network access to Valkey can cause the system to abort by triggering an assertion. When processing incoming requests, the Valkey system does not properly reset the networking state after processing an empty request. A malicious actor can then send a request that the server incorrectly identifies as breaking server side invariants, which results in the server shutting down. Version 9.0.3 fixes the issue. As an additional mitigation, properly isolate Valkey deployments so that only trusted users have access.

AnalysisAI

Denial of service in Valkey 9.0.0 through 9.0.2 allows unauthenticated network attackers to crash the server by exploiting improper networking state handling after empty requests. An attacker can trigger an assertion failure that causes the Valkey process to abort, impacting availability for all users. No patch is currently available; network isolation is recommended as a mitigation.

Technical ContextAI

Classified as CWE-20 (Improper Input Validation). Affects Valkey. Valkey is a distributed key-value database. Starting in version 9.0.0 and prior to version 9.0.3, a malicious actor with network access to Valkey can cause the system to abort by triggering an assertion. When processing incoming requests, the Valkey system does not properly reset the networking state after processing an empty request. A malicious actor can then send a request that the server incorrectly identifies as breaking server side invariants, which results in the server shutting down. Ver

RemediationAI

Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.

More in Valkey

View all

CVE-2025-21605 HIGH This Week

7.5 Apr 23

Redis is an open source, in-memory database that persists on disk. Rated high severity (CVSS 7.5), this vulnerability is

CVE-2026-21863 HIGH This Week

7.5 Feb 23

Out-of-bounds read in Valkey clusterbus port processing allows network-adjacent attackers to crash affected systems by s

CVE-2025-67733 HIGH This Week

7.1 Feb 23

Response-stream injection in Valkey (the Redis fork) lets an authenticated user abuse Lua scripting commands to smuggle

Same weakness CWE-20 – Improper Input Validation

View all

CVE-2021-44228 CRITICAL POC

10.0

CVE-2024-3400 CRITICAL POC

10.0

CVE-2022-47966 CRITICAL POC

9.8

CVE-2023-22515 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2017-9791 CRITICAL POC

9.8

CVE-2017-15944 CRITICAL POC

9.8

CVE-2019-0604 CRITICAL POC

9.8

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: High

Product	Status
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7	Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7	Fixed
SUSE Linux Enterprise Server 15 SP7	Fixed
SUSE Linux Enterprise Server 16.0	Fixed

CVE-2026-27623 vulnerability details – vuln.today

Back

SUSE Linux Enterprise Server 16.1	Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP7	Fixed
SUSE Linux Enterprise Server for SAP applications 16.0	Fixed
SUSE Linux Enterprise Server for SAP applications 16.1	Fixed
openSUSE Leap 15.6	Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP6	Fixed
SUSE Linux Enterprise Server 15 SP6	Fixed
SUSE Linux Enterprise Server 15 SP6-LTSS	Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP6	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP6	Fixed
private-registry/harbor-valkey suse/valkey	Fixed

Valkey CVE-2026-27623

Severity by source

CVSS VectorVendor: github

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Valkey

Same weakness CWE-20 – Improper Input Validation

Same technique Denial Of Service

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code