p PatchFirst

CVE-2026-21863

CVE-2026-21863 · Malformed Valkey Cluster bus message can lead to Remote DoS

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious actor with access to the Valkey clusterbus port can send an invalid packet that may cause an out bound read, which might result in the system crashing. The Valkey clusterbus packet processing code does not validate that a clusterbus ping extension packet is located within buffer of the clusterbus packet before attempting to read it. Versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12 fix the issue. As an additional mitigation, don't expose the cluster bus connection directly to end users, and protect the connection with its own network ACLs.

CVSS 7.5 · High · EPSS 0.8% · Fix available

Published
Updated

Stack: system · database

Affected products and versions

  • valkey

    Versions
    • < 7.2.12: Affected
    • >= 8.0.0, < 8.0.7: Affected
    • >= 8.1.0, < 8.1.6: Affected
    • >= 9.0.0, < 9.0.2: Affected

    No fix published

  • redict Debian:14

    Versions
    • 7.3.0+ds-1
    • 7.3.0+ds-2
    • 7.3.0+ds-3
    • 7.3.0+ds-3~bpo12+1
    • 7.3.1+ds-1
    • 7.3.2+ds-1
    • 7.3.2+ds-1~bpo12+1
    • 7.3.5+ds-1
    • 7.3.5+ds-1~bpo12+1
    • 7.3.6+ds-1
    • 7.3.6+ds-1~bpo12+1
    • 7.3.6+ds-1~bpo13+1
    • 7.3.6+ds-2~bpo12+1
    • 7.3.6+ds-2~bpo13+1
    Affected ranges
    • ECOSYSTEM: < 7.3.6+ds-2

    Update to 7.3.6+ds-2

  • redis Debian:12

    Versions
    • 5:7.0.11-1
    • 5:7.0.11-1+deb12u1
    • 5:7.0.12-1
    • 5:7.0.12-2
    • 5:7.0.13-1
    • 5:7.0.13-2
    • 5:7.0.14-1
    • 5:7.0.14-2
    • 5:7.0.15-1~deb12u1
    • 5:7.0.15-1~deb12u2
    • 5:7.0.15-1~deb12u3
    • 5:7.0.15-1~deb12u4
    • 5:7.0.15-1~deb12u5
    • 5:7.0.15-1~deb12u6
    Affected ranges
    • ECOSYSTEM: < 5:7.0.15-1~deb12u7

    Update to 5:7.0.15-1~deb12u7

  • redis Debian:13

    Versions
    • 5:8.0.2-3
    • 5:8.0.2-3+deb13u1
    Affected ranges
    • ECOSYSTEM: < 5:8.0.2-3+deb13u2

    Update to 5:8.0.2-3+deb13u2

  • redis Debian:14

    Versions
    • 5:8.0.2-3
    • 5:8.0.4-1
    • 5:8.0.5-1
    Affected ranges
    • ECOSYSTEM: < 5:8.0.6-1

    Update to 5:8.0.6-1

  • valkey Debian:13

    Versions
    • 8.1.1+dfsg1-3
    • 8.1.1+dfsg1-3+deb13u1
    Affected ranges
    • ECOSYSTEM: < 8.1.1+dfsg1-3+deb13u2

    Update to 8.1.1+dfsg1-3+deb13u2

  • valkey Debian:14

    Versions
    • 8.1.1+dfsg1-3
    • 8.1.4+dfsg1-1
    Affected ranges
    • ECOSYSTEM: < 8.1.4+dfsg1-2

    Update to 8.1.4+dfsg1-2

  • valkey Ubuntu:24.04:LTS

    Versions
    • 7.2.5+dfsg1-2ubuntu4~24.04.1
    • 7.2.7+dfsg1-0ubuntu0.24.04.1
    • 7.2.8+dfsg1-0ubuntu0.24.04.1
    • 7.2.8+dfsg1-0ubuntu0.24.04.2
    • 7.2.8+dfsg1-0ubuntu0.24.04.3
    • 7.2.10+dfsg1-0ubuntu0.1
    • 7.2.11+dfsg1-0ubuntu0.1
    • 7.2.11+dfsg1-0ubuntu0.2
    Affected ranges
    • ECOSYSTEM: < 7.2.12+dfsg1-0ubuntu0.1

    Update to 7.2.12+dfsg1-0ubuntu0.1

  • valkey Ubuntu:25.10

    Versions
    • 8.0.2+dfsg1-1ubuntu1
    • 8.1.1+dfsg1-2ubuntu1
    • 8.1.3+dfsg1-0ubuntu1
    • 8.1.3+dfsg1-0ubuntu2
    • 8.1.4+dfsg1-0ubuntu0.1
    • 8.1.4+dfsg1-0ubuntu0.2
    Affected ranges
    • ECOSYSTEM: < 8.1.6+dfsg1-0ubuntu0.1

    Update to 8.1.6+dfsg1-0ubuntu0.1

Original sources

Check your server →