CVE-2026-27623: Valkey has Pre-Authentication DOS from malformed RESP request
Valkey is a distributed key-value database. Starting in version 9.0.0 and prior to version 9.0.3, a malicious actor with network access to Valkey can cause the system to abort by triggering an assertion. When processing incoming requests, the Valkey system does not properly reset the networking state after processing an empty request. A malicious actor can then send a request that the server incorrectly identifies as breaking server side invariants, which results in the server shutting down. Version 9.0.3 fixes the issue. As an additional mitigation, properly isolate Valkey deployments so that only trusted users have access.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Valkeyto a version that resolves this vulnerability.Fixed in 9.0.3 - Compensating control
Properly isolate Valkey deployments so that only trusted users have access.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27623?
CVE-2026-27623 has been classified with a severity rating that indicates a potential denial-of-service condition.
How do I fix CVE-2026-27623?
To fix CVE-2026-27623, upgrade the Valkey system to version 9.0.3 or later.
Who is affected by CVE-2026-27623?
CVE-2026-27623 affects Valkey versions 9.0.0 to 9.0.2.
What are the risks associated with CVE-2026-27623?
The risk associated with CVE-2026-27623 is that it could allow a malicious actor to cause the Valkey system to abort.
Is there a workaround for CVE-2026-27623 until I can upgrade?
Currently, there is no public workaround available for CVE-2026-27623, so upgrading is the recommended approach.