CVE-2026-21863: Malformed Valkey Cluster bus message can lead to Remote DoS
Malformed Valkey Cluster bus message can lead to Remote DoS
Other sources
Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious actor with access to the Valkey clusterbus port can send an invalid packet that may cause an out bound read, which might result in the system crashing. The Valkey clusterbus packet processing code does not validate that a clusterbus ping extension packet is located within buffer of the clusterbus packet before attempting to read it. Versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12 fix the issue. As an additional mitigation, don't expose the cluster bus connection directly to end users, and protect the connection with its own network ACLs.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.0.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.1.6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.0.7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.2.12 - Compensating control
Do not expose the Valkey cluster bus connection/clusterbus port directly to end users; instead, protect it with its own network ACLs so only trusted clients/systems can access the clusterbus port.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-21863?
CVE-2026-21863 has a high severity level due to the potential for system crashes caused by malformed packets.
How do I fix CVE-2026-21863?
To remediate CVE-2026-21863, upgrade to Valkey versions 9.0.2, 8.1.6, 8.0.7, or 7.2.12 or later.
Who is affected by CVE-2026-21863?
CVE-2026-21863 affects users running Valkey versions earlier than 9.0.2, 8.1.6, 8.0.7, or 7.2.12.
What causes CVE-2026-21863?
CVE-2026-21863 is caused by a malicious actor sending an invalid packet through the Valkey clusterbus port.
Can CVE-2026-21863 lead to data loss?
While CVE-2026-21863 primarily causes system crashes, it may also lead to temporary service disruption and potential data loss depending on the circumstances.