CVE-2026-21863 Details
Description
Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious actor with access to the Valkey clusterbus port can send an invalid packet that may cause an out bound read, which might result in the system crashing. The Valkey clusterbus packet processing code does not validate that a clusterbus ping extension packet is located within buffer of the clusterbus packet before attempting to read it. Versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12 fix the issue. As an additional mitigation, don't expose the cluster bus connection directly to end users, and protect the connection with its own network ACLs.
A denial-of-service vulnerability has been identified in Valkey, a distributed key-value database, in versions prior to 9.0.2, 8.1.6, 8.0.7, and 7.2.12. The issue arises in the Valkey clusterbus packet processing code, which fails to properly validate the presence of a clusterbus ping extension packet within the buffer before attempting to read it. This lack of validation allows a malicious actor with access to the Valkey clusterbus port to send an invalid packet that could cause an out-of-bounds read, potentially leading to a crash of the Valkey process.
Users are advised to update to Valkey versions 9.0.3, 8.1.6, 8.0.7, or 7.2.12. Additionally, the clusterbus port should not be exposed directly to end users and should be protected with its own network ACLs.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://access.redhat.com/errata/RHSA-2026:3443 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:3507 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:5445 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:8753 | redhat-SADP | |
| https://access.redhat.com/security/cve/CVE-2026-21863 | redhat-SADP | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2442026 | redhat-SADP | |
| https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-21863.json | redhat-SADP | |
| https://github.com/valkey-io/valkey/security/advisories/GHSA-c677-q3wr-gggq | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | redhat-SADP |
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| lfprojects valkey | < 7.2.12 >= 8.0.0, < 8.0.7 >= 8.1.0, < 8.1.6 >= 9.0.0, < 9.0.2 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 25, 2026 | Initial Analysis | [email protected] |
| Feb 23, 2026 | New CVE Received | [email protected] |