CVE-2026-21863: 
Redis vulnerability analysis and mitigation

CVE-2026-21863 is an out-of-bounds read vulnerability in Valkey's cluster bus packet processing that allows a remote attacker with network access to the clusterbus port to crash the Valkey process via a malformed packet, resulting in denial of service. It affects Valkey versions prior to 7.2.12, 8.0.7, 8.1.6, and 9.0.2 (across the 7.2.x, 8.0.x, 8.1.x, and 9.0.x branches). The vulnerability was published on February 23, 2026, with patches released the same day. The GitHub Security Advisory assigns a CVSS v3.1 score of 6.5 (Moderate) with an adjacent network attack vector, while NVD scores it 7.5 (High) using a network attack vector (GitHub Advisory, Microsoft MSRC).

The root cause is an out-of-bounds read (CWE-125) in Valkey's clusterbus packet processing code. Specifically, the code does not validate that a clusterbus ping extension packet is located within the bounds of the clusterbus packet buffer before attempting to read it, allowing a read beyond allocated memory. An attacker with network access to the clusterbus port (typically TCP port 16379 or the client port +10000) can send a specially crafted, malformed ping extension packet to trigger the out-of-bounds read, which causes the Valkey process to crash. No authentication is required; the only precondition is network reachability to the clusterbus port (GitHub Advisory).

Successful exploitation causes the Valkey server process to terminate, resulting in a denial of service for all clients depending on that node. In a clustered deployment, crashing a node may trigger failover procedures and temporary service disruption across the cluster. There is no confidentiality or integrity impact — the vulnerability is limited to availability (GitHub Advisory, Percona Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability was discovered by security researcher 0x Kato (0xkkato@gmail.com) and responsibly disclosed. The EPSS score is approximately 0.015% (0.000150), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Feedly).

1. Reconnaissance: Identify Valkey cluster nodes with the clusterbus port exposed to the network. The clusterbus port is typically the client port plus 10000 (e.g., if Valkey listens on port 6379, the clusterbus port is 16379). Use network scanning tools such as Nmap to discover open clusterbus ports.
2. Craft malformed packet: Construct a Valkey clusterbus packet containing a ping extension sub-packet whose offset or length fields point outside the bounds of the enclosing packet buffer. The extension packet header should reference data beyond the allocated packet buffer.
3. Send the packet: Transmit the malformed clusterbus packet directly to the target's clusterbus TCP port. No authentication credentials are required.
4. Trigger crash: The Valkey process attempts to read the ping extension data at the invalid memory location, causing an out-of-bounds read that terminates the process, resulting in denial of service (GitHub Advisory).

• Network: Unexpected or repeated TCP connections to the Valkey clusterbus port (default: client port + 10000, e.g., 16379) from untrusted or external IP addresses; malformed or unusually short clusterbus packets in network captures.
• Logs: Valkey process crash logs or core dump files generated around the time of the connection; operating system logs (e.g., dmesg, journalctl) showing the Valkey process terminated with a segmentation fault or similar memory error.
• Process: Sudden absence of the valkey-server process; automatic restart events triggered by a process supervisor (e.g., systemd, supervisord) indicating unexpected process termination.

Upgrade to one of the patched Valkey releases: 9.0.2, 8.1.6, 8.0.7, or 7.2.12, depending on the branch in use. As an additional mitigation, restrict access to the clusterbus port using network ACLs or firewall rules so that only trusted cluster nodes can connect — do not expose the clusterbus port directly to end users or untrusted networks. Red Hat has issued errata (RHSA-2026:3443, RHSA-2026:3507, RHSA-2026:5445) and Ubuntu has issued USN-8106-1 for downstream package updates (GitHub Advisory, Red Hat Errata, Ubuntu Advisory).

Percona published a security advisory covering this and related Valkey CVEs, recommending immediate patching and network-level mitigations (Percona Advisory). The vulnerability received routine coverage from Linux distribution security channels (Red Hat, Ubuntu, Fedora, Rocky Linux, Debian, AlmaLinux) and security news aggregators, with no notable controversy or significant social media discussion beyond standard vulnerability disclosure activity.