EUVD-2026-72176
GHSA-74wm-q835-hxf9
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Cluster mode requirement plus attacker-controlled RDB precondition justify AC:H; replication or data-dir access needed sets PR:L; only a boot-time crash with no confidentiality or integrity impact yields A:L/C:N/I:N.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
6DescriptionCVE.org
A weakness has been identified in valkey-io valkey up to 9.0.5/9.1.1. This affects the function kvstoreGetHashtable of the file src/kvstore.c. This manipulation of the argument didx causes out-of-bounds read. It is possible to initiate the attack remotely. The attack is considered to have high complexity. It is indicated that the exploitability is difficult. The exploit has been made available to the public and could be used for attacks. Patch name: 4691888e7fab3df128f0bde5750c9fde2ae552fa. To fix this issue, it is recommended to deploy a patch. Exploitation requires cluster mode plus attacker-controlled dump.rdb at startup (data-dir write access, replication feed, or a stored crafted RDB) - an attacker-position DoS at boot, not network pre-auth. The issue report was closed stating it "is worth fixing for the sake of memory safety… but I don't think it meets our bar for a security disclosure."
AnalysisAI
Out-of-bounds read in Valkey's kvstoreGetHashtable function (src/kvstore.c) allows an attacker who can supply a crafted RDB file at server startup to corrupt the didx argument beyond the valid hashtable index range, crashing the process and rendering the cluster node unavailable. Affected versions are ≤9.0.5 (stable) and ≤9.1.1 (development branch); exploitation requires cluster mode and attacker-controlled RDB input, making this a constrained, low-severity DoS limited to the startup phase. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all three of the following: (1) Valkey must be running in cluster mode - the vulnerable `clusterRDBLoadSlotImport` code path is unreachable in standalone mode; (2) the attacker must control or corrupt the dump.rdb loaded at startup, achievable via write access to the Valkey data directory, injection through a rogue or compromised replication feed, or pre-planting the crafted file during initial cluster provisioning; (3) a Valkey process restart must occur to trigger RDB loading. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:H/PR:L/VA:L, score 2.3) and the description are well-aligned and consistently characterize this as a low-priority issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply upstream patch commit 4691888e7fab3df128f0bde5750c9fde2ae552fa, available via pull request #4229 at https://github.com/valkey-io/valkey/pull/4229. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
UAF in Redis 8.2.1 via crafted Lua scripts by authenticated users. EPSS 12.4%. Patch available.
Out-of-bounds read in Valkey's cluster slot-migration RDB loader allows a network-positioned attacker to crash affected
Use-after-free in Valkey's RESTORE command allows a low-privileged remote attacker to potentially execute arbitrary code
Use-after-free in Valkey's TLS connection handler allows an authenticated remote attacker to crash the server or potenti
Redis is an open source, in-memory database that persists on disk. Rated high severity (CVSS 7.5), this vulnerability is
Denial of service in Valkey 9.0.0 through 9.0.2 allows unauthenticated network attackers to crash the server by exploiti
Out-of-bounds read in Valkey clusterbus port processing allows network-adjacent attackers to crash affected systems by s
Response-stream injection in Valkey (the Redis fork) lets an authenticated user abuse Lua scripting commands to smuggle
Double-free memory corruption in Valkey 9.1.0's Module Timer Subsystem allows a high-privileged remote attacker to crash
Same weakness CWE-125 – Out-of-bounds Read
View allShare
External POC / Exploit Code
Leaving vuln.today