CVE-2026-85522: 
Valkey vulnerability analysis and mitigation

CVE-2026-85522 is a heap out-of-bounds read vulnerability in the Slot Migration component of valkey-io Valkey, a high-performance distributed key-value database. The flaw exists in the createSlotImportJob() function within src/cluster_migrateslots.c, where a crafted RDB file containing a RDB_OPCODE_SLOT_IMPORT record with a job_name shorter than the expected 40 bytes (CLUSTER_NAMELEN) triggers an over-read during server startup. Affected versions include Valkey 9.0 through 9.5.4 and 9.1.0; fixed versions are 9.0.5 and 9.1.1. It carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 5.5 (Medium) (GitHub Advisory, Valkey Issue #4207).

The root cause is a length-contract mismatch (CWE-125: Out-of-bounds Read; CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer) in the RDB loading path. clusterRDBLoadSlotImport() reads job_name via rdbLoadStringObject() — which accepts variable-length strings — and passes the result directly to createSlotImportJob(), which unconditionally executes memcpy(job->name, name, CLUSTER_NAMELEN) (40 bytes) without validating that the source string is exactly 40 bytes long. If an attacker supplies a crafted RDB with a 1-byte job_name, the server performs a 40-byte read from a 1-byte heap allocation, causing a heap buffer overflow read. The command-path for slot migration already enforced the 40-byte invariant, but the RDB load path did not. AddressSanitizer confirms the violation at cluster_migrateslots.c:793 in createSlotImportJob() (Valkey Issue #4207, Valkey PR #4210).

Successful exploitation causes a reliable denial of service: the Valkey server crashes during startup RDB loading before it can accept client connections, preventing the instance from becoming operational. The crash occurs in the main thread during loadDataFromDisk(), meaning a single crafted RDB file can permanently prevent a cluster node from starting. There is no confirmed confidentiality or integrity impact beyond the out-of-bounds memory read itself; the primary risk is availability loss for cluster-enabled Valkey deployments (Valkey Issue #4207, Feedly).

A proof-of-concept exploit is publicly available and was included in the original issue report, with detailed reproduction steps using Python and standard build tools. The vulnerability is remotely exploitable without authentication, requiring only the ability to supply a crafted RDB file to a cluster-enabled Valkey instance (e.g., via RDB replication, file system access, or backup restoration). The CVSS v4.0 exploit maturity is rated PROOF_OF_CONCEPT. The EPSS score is 0.0, and there is no evidence of active in-the-wild exploitation or CISA KEV catalog listing as of the disclosure date (Feedly, Valkey Issue #4207).

1. Identify target: Locate a Valkey cluster-enabled instance (configured with cluster-enabled yes) running versions 9.0–9.5.4 or 9.1.0 that loads RDB files on startup.
2. Generate a baseline RDB: Start a Valkey server instance and issue SAVE to produce a valid empty dump.rdb file.
3. Craft the malicious RDB: Using Python, strip the last 9 bytes (EOF opcode + CRC64 checksum) from the baseline RDB, append a RDB_OPCODE_SLOT_IMPORT (0xF3) record with a 1-byte job_name (e.g., 'A'), one slot range (0–0), and a zero checksum (treated as disabled by the loader):

   record = bytes([0xF3, 0x01]) + b'A' + bytes([0x01, 0x00, 0x00]) + bytes([0xFF])

4. Deploy the crafted RDB: Place the malicious file as dump.rdb in the Valkey data directory of the target instance (via file system access, RDB replication manipulation, or backup injection).
5. Trigger the crash: Start the Valkey server with cluster-enabled yes pointing to the crafted RDB. During loadDataFromDisk(), clusterRDBLoadSlotImport() reads the 1-byte job_name and passes it to createSlotImportJob(), which performs memcpy(job->name, name, 40) on a 1-byte allocation, causing a heap out-of-bounds read and server crash/abort before the instance reaches readiness (Valkey Issue #4207).

• Logs: Valkey server log containing Invalid slot import job name length in RDB (post-patch, indicating a rejected malformed RDB); Fatal error loading the DB, Short read or OOM loading DB, or Aborting messages during startup.
• Process: Valkey server process (valkey-server) terminating immediately during startup before logging Ready to accept connections; AddressSanitizer output containing heap-buffer-overflow in createSlotImportJob at cluster_migrateslots.c.
• File System: Presence of an unexpected or externally sourced dump.rdb file in the Valkey data directory; RDB file containing the byte sequence 0xF3 (RDB_OPCODE_SLOT_IMPORT) followed by a short-length string encoding (e.g., 0x01 for 1-byte length).
• Network: Unexpected RDB replication transfers or file replacements on cluster nodes not initiated by legitimate cluster operations (Valkey Issue #4207).

Upgrade Valkey to version 9.0.5 or 9.1.1 immediately; these releases include the fix (commit f4dc3ca09eb650c2fe14060090a41c524eca803f) that adds a length validation check in clusterRDBLoadSlotImport() to reject any job_name not exactly CLUSTER_NAMELEN (40) bytes before calling createSlotImportJob(). As a workaround where upgrading is not immediately possible, restrict write access to the Valkey data directory and RDB files to prevent unauthorized RDB injection, and limit network access to Valkey instances to trusted clients only. Use valkey-check-rdb (also patched in 9.0.5/9.1.1) to validate RDB files before loading them (Valkey Release 9.1.1, Valkey PR #4210).

The vulnerability was responsibly reported by researcher gff-cw via a detailed GitHub issue with full GDB and ASan evidence, reproduction steps, and a proposed patch. The Valkey maintainers responded promptly, with the fix merged within three days of the report (July 18–21, 2026) and backported to both the 9.0 and 9.1 stable branches. The 9.1.1 release notes classify the fix under security-relevant bug fixes alongside other CVEs in that release (Valkey Issue #4207, Valkey Release 9.1.1).