CVE-2026-21863

Malformed Valkey Cluster bus message can lead to Remote DoS

HIGH

7.5

CVSS Score

Published: February 23, 2026 at 07:41 PM UTC

Updated: July 15, 2026 at 02:18 AM UTC

2 products affected across 2 vendorsValkeyValkey

Using valkey by valkey-io?

Get instant alerts when new vulnerabilities affect valkey - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.5

Exploit prediction

EPSS 0.8%

SSVC

No known exploit

Description

Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious actor with access to the Valkey clusterbus port can send an invalid packet that may cause an out bound read, which might result in the system crashing. The Valkey clusterbus packet processing code does not validate that a clusterbus ping extension packet is located within buffer of the clusterbus packet before attempting to read it. Versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12 fix the issue. As an additional mitigation, don't expose the cluster bus connection directly to end users, and protect the connection with its own network ACLs.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Valkey · Lfprojects

95%

v < 7.2.128.0.0 ≤ v < 8.0.78.1.0 ≤ v < 8.1.69.0.0 ≤ v < 9.0.2

Affected range stops below 7.2.12, so it looks safe — our inference, not a vendor statement

Affected range stops below 8.0.7, so it looks safe — our inference, not a vendor statement

Affected range stops below 8.1.6, so it looks safe — our inference, not a vendor statement

Affected range stops below 9.0.2, so it looks safe — our inference, not a vendor statement

Valkey · Valkey Io

60%

v < 7.2.12v < 8.0.7v < 8.1.6v < 9.0.2

Affected range stops below 7.2.12, so it looks safe — our inference, not a vendor statement

Affected range stops below 8.0.7, so it looks safe — our inference, not a vendor statement

Affected range stops below 8.1.6, so it looks safe — our inference, not a vendor statement

Affected range stops below 9.0.2, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://github.com/valkey-io/valkey/security/advisories/GHSA-c677-q3wr-gggq