EUVD-2026-71102
GHSA-cmxq-3354-mw5w
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Delivering a crafted RDB requires controlling the replication source or MITM on the replication channel, warranting AC:H; impact is crash-only with no confirmed confidentiality or integrity loss.
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
6DescriptionCVE.org
A vulnerability was detected in valkey-io valkey up to 9.5.4/9.1.0. Affected by this vulnerability is the function createSlotImportJob of the file src/cluster_migrateslots.c of the component Slot Migration. The manipulation of the argument job_name results in out-of-bounds read. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version 9.0.5 and 9.1.1 addresses this issue. The patch is identified as f4dc3ca09eb650c2fe14060090a41c524eca803f. Upgrading the affected component is advised.
AnalysisAI
Out-of-bounds read in Valkey's cluster slot-migration RDB loader allows a network-positioned attacker to crash affected servers by supplying a crafted RDB file with a truncated job_name field in an RDB_OPCODE_SLOT_IMPORT record. Valkey versions up to 9.0.4 and 9.1.0 running in cluster mode are affected; the vulnerable createSlotImportJob() function in src/cluster_migrateslots.c performs a fixed 40-byte memcpy without first validating that the loaded job_name is exactly CLUSTER_NAMELEN bytes, triggering CWE-125 on undersized input. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target Valkey server must be running with `cluster-enabled yes` for the vulnerable `RDB_OPCODE_SLOT_IMPORT` parsing path to be active. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P) scores this at 6.9, reflecting network-reachable availability impact only - no confidentiality or integrity compromise is confirmed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Valkey 9.0.5 (for the 9.0.x branch) or Valkey 9.1.1 (for the 9.1.x branch), which incorporate the length-validation fix from commit f4dc3ca09eb650c2fe14060090a41c524eca803f via PR #4210 (https://github.com/valkey-io/valkey/pull/4210). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
UAF in Redis 8.2.1 via crafted Lua scripts by authenticated users. EPSS 12.4%. Patch available.
Use-after-free in Valkey's RESTORE command allows a low-privileged remote attacker to potentially execute arbitrary code
Use-after-free in Valkey's TLS connection handler allows an authenticated remote attacker to crash the server or potenti
Redis is an open source, in-memory database that persists on disk. Rated high severity (CVSS 7.5), this vulnerability is
Denial of service in Valkey 9.0.0 through 9.0.2 allows unauthenticated network attackers to crash the server by exploiti
Out-of-bounds read in Valkey clusterbus port processing allows network-adjacent attackers to crash affected systems by s
Response-stream injection in Valkey (the Redis fork) lets an authenticated user abuse Lua scripting commands to smuggle
Double-free memory corruption in Valkey 9.1.0's Module Timer Subsystem allows a high-privileged remote attacker to crash
Out-of-bounds read in Valkey's `kvstoreGetHashtable` function (src/kvstore.c) allows an attacker who can supply a crafte
Same weakness CWE-125 – Out-of-bounds Read
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Module for Server Applications 15 SP7 | Not-Affected |
| SUSE Linux Enterprise Server 15 SP7 | Not-Affected |
| SUSE Linux Enterprise Server 16.0 | Not-Affected |
| SUSE Linux Enterprise Server 16.1 | Not-Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP7 | Not-Affected |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Not-Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Not-Affected |
| openSUSE Leap 16.0 | Not-Affected |
| SUSE Linux Enterprise Module for Server Applications 15 SP6 | Not-Affected |
| SUSE Linux Enterprise Server 15 SP6 | Not-Affected |
| SUSE Linux Enterprise Server 15 SP6-LTSS | Not-Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | Not-Affected |
| openSUSE Leap 15.6 | Not-Affected |
| private-registry/harbor-valkey suse/valkey | Not-Affected |
Share
External POC / Exploit Code
Leaving vuln.today