CVE-2026-85522

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-85522
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85522.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-85522
Downstream
Published
2026-09-04T13:45:15.397Z
Modified
2026-09-06T08:03:30.839215Z
Severity
  • 5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
valkey-io valkey Slot Migration cluster_migrateslots.c createSlotImportJob out-of-bounds
Details

A vulnerability was detected in valkey-io valkey up to 9.5.4/9.1.0. Affected by this vulnerability is the function createSlotImportJob of the file src/clustermigrateslots.c of the component Slot Migration. The manipulation of the argument jobname results in out-of-bounds read. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version 9.0.5 and 9.1.1 addresses this issue. The patch is identified as f4dc3ca09eb650c2fe14060090a41c524eca803f. Upgrading the affected component is advised.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85522.json",
    "cwe_ids": [
        "CWE-119",
        "CWE-125"
    ],
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "9.5.0"
                },
                {
                    "last_affected": "9.5.0"
                },
                {
                    "introduced": "9.5.1"
                },
                {
                    "last_affected": "9.5.1"
                },
                {
                    "introduced": "9.5.2"
                },
                {
                    "last_affected": "9.5.2"
                },
                {
                    "introduced": "9.5.3"
                },
                {
                    "last_affected": "9.5.3"
                },
                {
                    "introduced": "9.5.4"
                },
                {
                    "last_affected": "9.5.4"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cna_assigner": "VulDB"
}
References

Affected packages

Git / github.com/valkey-io/valkey

Affected ranges

Type
GIT
Repo
https://github.com/valkey-io/valkey
Events
Introduced
5018b12b0de2d2322a1bbf6b041c43740587c0f2
Fixed
f4dc3ca09eb650c2fe14060090a41c524eca803f
Fixed
d27f9ba65a04e80d9c417112a7621fc98a56f70d
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "9.0"
        },
        {
            "last_affected": "9.0"
        },
        {
            "introduced": "9.1.0"
        },
        {
            "last_affected": "9.1.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

9.*
9.0
9.1.0

Database specific

vanir_signatures 
[
    {
        "signature_version": "v1",
        "signature_type": "Line",
        "id": "CVE-2026-85522-20afd36e",
        "deprecated": false,
        "source": "https://github.com/valkey-io/valkey/commit/f4dc3ca09eb650c2fe14060090a41c524eca803f",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "289732051197132742954732338615065204449",
                "70655666461619806788200918257959674863",
                "92390355189496512603646664992712679004",
                "105210590585975565991067427150238787488",
                "117410053787947586361783603192025500186",
                "100037096293135272472022968165820511408",
                "64296383575890253920578987508067962521",
                "6009158529094445051917928321340168528"
            ]
        },
        "target": {
            "file": "src/valkey-check-rdb.c"
        }
    },
    {
        "signature_version": "v1",
        "signature_type": "Function",
        "id": "CVE-2026-85522-27d4d283",
        "deprecated": false,
        "source": "https://github.com/valkey-io/valkey/commit/f4dc3ca09eb650c2fe14060090a41c524eca803f",
        "digest": {
            "length": 985.0,
            "function_hash": "194939063328871531263883120814693435455"
        },
        "target": {
            "file": "src/cluster_migrateslots.c",
            "function": "clusterRDBLoadSlotImport"
        }
    },
    {
        "signature_version": "v1",
        "signature_type": "Line",
        "id": "CVE-2026-85522-718ac0d3",
        "deprecated": false,
        "source": "https://github.com/valkey-io/valkey/commit/f4dc3ca09eb650c2fe14060090a41c524eca803f",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "297003267402876032719580173420098469707",
                "146940633496225008880715808321288457918",
                "9589451743216025819020868640102372705",
                "84947760564387773732297220444626317649",
                "233614405693893645755684312512637193459",
                "320432793003249952933498472884690135279",
                "288496837219033642275220888269234554369"
            ]
        },
        "target": {
            "file": "src/cluster_migrateslots.c"
        }
    },
    {
        "signature_version": "v1",
        "signature_type": "Function",
        "id": "CVE-2026-85522-73f6a98b",
        "deprecated": false,
        "source": "https://github.com/valkey-io/valkey/commit/f4dc3ca09eb650c2fe14060090a41c524eca803f",
        "digest": {
            "length": 6637.0,
            "function_hash": "268493376520263387778217081833750296233"
        },
        "target": {
            "file": "src/valkey-check-rdb.c",
            "function": "redis_check_rdb"
        }
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85522.json"
vanir_signatures_modified 
"2026-09-06T08:03:30Z"