ZDI-CAN-28318: ZDI-26-833: Valkey clusterCreatePublishMsgBlock Numeric Truncation Error Remote Code Execution Vulnerability
Published Oct 28, 2026
·Updated
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Valkey. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8.
Affected Software
1 affected component
Valkey Valkey
Event History
Oct 28, 2026
Advisory Published
via ZDI·05:00 AM
Data Sourced
via ZDI·05:00 AM
Description
Frequently Asked Questions
1
Who can exploit this issue?
An attacker must authenticate to an affected Valkey installation before exploiting the vulnerability. The provided information does not identify which authenticated roles or permission levels are sufficient.
2
What is the potential impact after successful exploitation?
A successful attacker can execute arbitrary code on the affected Valkey installation. ZDI assigned the issue a CVSS rating of 8.8.