CVE-2026-21863: lfprojects valkey Out-of-bounds Read
Vulnerability summary
CVE-2026-21863 is a high (CVSS 7.5) Out-of-bounds Read vulnerability in lfprojects valkey. EPSS estimates a 0.79% chance of exploitation in the next 30 days, higher than 55.5% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 6 · Related 4Timeline
- 23-02-2026PublishedVulnerability first disclosed.
- 15-07-2026Last modifiedVulnerability information updated.
Description
Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious actor with access to the Valkey clusterbus port can send an invalid packet that may cause an out bound read, which might result in the system crashing. The Valkey clusterbus packet processing code does not validate that a clusterbus ping extension packet is located within buffer of the clusterbus packet before attempting to read it. Versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12 fix the issue. As an additional mitigation, don't expose the cluster bus connection directly to end users, and protect the connection with its own network ACLs.
CVSS metrics
6 scores · 6 sources · 1 version- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · Red hatEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.79%
Chance of exploitation in the next 30 days
Percentile
56%
Versus all other CVEs
30-day change
+0.03 pp
From 0.76% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat6 products
- valkey< 0:9.0.3-1.2.hum1
- valkey-compat-redis< 0:9.0.3-1.2.hum1
- valkey-compat-redis-devel< 0:9.0.3-1.2.hum1
- valkey-devel< 0:9.0.3-1.2.hum1
- valkey-doc< 0:9.0.3-1.2.hum1
Debian3 products
- redict< 7.3.6+ds-2
- redis< 5:7.0.15-1~deb12u7 | < 5:8.0.2-3+deb13u2 | < 5:8.0.6-1
- valkey< 8.1.1+dfsg1-3+deb13u2 | < 8.1.4+dfsg1-2
Alpine1 product
- valkey≥ 8.0.0, < 7.2.12-r0 | ≥ 8.0.0, < 8.1.6-r0 | ≥ 8.0.0, < 9.0.3-r0
Lfprojects1 product
- valkey< 7.2.12 | ≥ 8.0.0, < 8.0.7 | ≥ 8.1.0, < 8.1.6 | ≥ 9.0.0, < 9.0.2
Ubuntu1 product
- valkey< 7.2.12+dfsg1-0ubuntu0.1 | < 8.1.6+dfsg1-0ubuntu0.1
Valkey-io1 product
- valkey< 7.2.12 | ≥ 8.0.0, < 8.0.7 | ≥ 8.1.0, < 8.1.6 | ≥ 9.0.0, < 9.0.2
6 vendors · 13 products
References
17 links- github.com/valkey-io/valkey/security/advisories/GHSA-c677-q3wr-gggqX Refsource CONFIRMARTICLEREPORTVendor Advisory
- images.redhat.comARTICLE
