VDB
CVE-2026-85522
CVE-2026-85522
PUBLISHED
CVSS 6.9 MEDIUM
Reported by VulDB · Published September 4, 2026
A vulnerability was detected in valkey-io valkey up to 9.5.4/9.1.0. Affected by this vulnerability is the function createSlotImportJob of the file src/cluster_migrateslots.c of the component Slot Migration. The manipulation of the argument job_name results in out-of-bounds read. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version 9.0.5 and 9.1.1 addresses this issue. The patch is identified as f4dc3ca09eb650c2fe14060090a41c524eca803f. Upgrading the affected component is advised.
Risk Scores
CVSS 4.0
6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| valkey-io | valkey | 9.0, 9.1.0, 9.5.0 |
| valkey-io | valkey | 9.0, 9.1.0, 9.5.0 |
Timeline
- Sep 4, 2026 Coalition ESS Score
- Sep 4, 2026 CVE Published
- Sep 4, 2026 CVE Updated
- Sep 5, 2026 EPSS Score
- Sep 6, 2026 EPSS Score
- Sep 9, 2026 EPSS Score
- Sep 12, 2026 EPSS Score
- Sep 16, 2026 EPSS Score
- Sep 18, 2026 EPSS Score
References
- VDB-398707 | valkey-io valkey Slot Migration cluster_migrateslots.c createSlotImportJob out-of-bounds vdb-entrytechnical-description
- VDB-398707 | CTI Indicators (IOB, IOC, IOA) signaturepermissions-required
- CVE-2026-85522 | CVE Analysis and Report third-party-advisory
- Submit #895119 | Valkey Project Valkey 9.1.0 Out-of-bounds Read third-party-advisory
- exploitissue-tracking
- issue-trackingpatch
- patch
- patch
- product