CVE-2026-21863

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-21863
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-21863.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-21863
Aliases
Downstream
Related
Published
2026-02-23T19:41:28.783Z
Modified
2026-03-06T09:59:18.098464Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Malformed Valkey Cluster bus message can lead to Remote DoS
Details

Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious actor with access to the Valkey clusterbus port can send an invalid packet that may cause an out bound read, which might result in the system crashing. The Valkey clusterbus packet processing code does not validate that a clusterbus ping extension packet is located within buffer of the clusterbus packet before attempting to read it. Versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12 fix the issue. As an additional mitigation, don't expose the cluster bus connection directly to end users, and protect the connection with its own network ACLs.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21863.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-125"
    ]
}
References

Affected packages

Git / github.com/valkey-io/valkey

Affected ranges

Type
GIT
Repo
https://github.com/valkey-io/valkey
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
7b696d1a4f8b2a5b5393dba7c6706f7aa8599013
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "7.2.12"
        }
    ]
}
Type
GIT
Repo
https://github.com/valkey-io/valkey
Events
Introduced
2b5c7a0dbd61fd4281ef6166b7d119ba7fe7368c
Fixed
d77c7aaf01d273d2480aeabf5ed578aa0133d9a1
Database specific 
{
    "versions": [
        {
            "introduced": "8.0.0"
        },
        {
            "fixed": "8.0.7"
        }
    ]
}
Type
GIT
Repo
https://github.com/valkey-io/valkey
Events
Introduced
67c8683792fc9ab7e295f833478eca180c5e4691
Fixed
19b07dfcbb75b14a1ed1b0a48cb8a0efcc81d563
Database specific 
{
    "versions": [
        {
            "introduced": "8.1.0"
        },
        {
            "fixed": "8.1.6"
        }
    ]
}
Type
GIT
Repo
https://github.com/valkey-io/valkey
Events
Introduced
5018b12b0de2d2322a1bbf6b041c43740587c0f2
Fixed
1ac4cfe4c877a6cb8cb2e28fa7094055ac06f64b
Database specific 
{
    "versions": [
        {
            "introduced": "9.0.0"
        },
        {
            "fixed": "9.0.2"
        }
    ]
}

Affected versions

7.*
7.2.10
7.2.11
7.2.4
7.2.4-rc1
7.2.5
7.2.5-rc1
7.2.6
7.2.7
7.2.8
7.2.9
8.*
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.1.5
9.*
9.0.0
9.0.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-21863.json"