DEBIAN-CVE-2026-85522

See a problem?
Please try reporting it to the source first.

Source

https://security-tracker.debian.org/tracker/CVE-2026-85522

Import Source

https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-85522.json

JSON Data

https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-85522

Upstream

CVE-2026-85522

Published

2026-09-04T14:17:22.807Z

Modified

2026-09-05T11:00:09.586603770Z

Severity

5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator

Summary

[none]

Details

A vulnerability was detected in valkey-io valkey up to 9.5.4/9.1.0. Affected by this vulnerability is the function createSlotImportJob of the file src/clustermigrateslots.c of the component Slot Migration. The manipulation of the argument jobname results in out-of-bounds read. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version 9.0.5 and 9.1.1 addresses this issue. The patch is identified as f4dc3ca09eb650c2fe14060090a41c524eca803f. Upgrading the affected component is advised.

References

https://security-tracker.debian.org/tracker/CVE-2026-85522

Affected packages

Debian:13 / valkey

Package

Name: valkey
Purl: pkg:deb/debian/valkey?arch=source&distro=trixie

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

8.*

8.1.1+dfsg1-3

8.1.1+dfsg1-3+deb13u1

8.1.1+dfsg1-3+deb13u2

8.1.4+dfsg1-1

8.1.4+dfsg1-2

9.*

9.1.1-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-85522.json"

Debian:14 / valkey