CVE-2026-21863 | Malformed Valkey Cluster bus message can lead to Remote DoS

Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious actor with access to the Valkey clusterbus port can send an invalid packet that may cause an out bound read, which might result in the system crashing. The Valkey clusterbus packet processing code does not validate that a clusterbus ping extension packet is located within buffer of the clusterbus packet before attempting to read it. Versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12 fix the issue. As an additional mitigation, don't expose the cluster bus connection directly to end users, and protect the connection with its own network ACLs.

Published: 2026-02-23 Last update: 2026-02-25 Assigner: [email protected] Source: [email protected]
NVD Status：Analyzed，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2026-21863 is rated Low Risk (31/100): CVSS High severity, with low exploitation likelihood (EPSS 0.01%). Monitor for updates and reassess as exploit intelligence or EPSS changes.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2026-21863

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-02-24 — 0.01% —

Full EPSS history (1 record total)

Common vulnerability scoring system (CVSS) metrics for CVE-2026-21863

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
7.5 3.1 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Click to expand
Attack vector (AV:N)
Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L)
Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N)
No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U)
Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:N)
Doesn’t really leak secrets in a meaningful way.
Integrity (I:N)
Data isn’t meaningfully altered or forged.
Availability (A:H)
Could take the service down hard or make it unusable for people who depend on it.
 3.9 3.6 [email protected]

Weakness enumeration for CVE-2026-21863

OS Trackers for CVE-2026-21863

vendor priority summary link
alpine — CVE-2026-21863: 1 source package rows (valkey); 30 state rows across 5 repos (3.20-main, 3.21-main, 3.22-main, 3.23-main, edge-main); fixed 4, open 26. https://security.alpinelinux.org/vuln/CVE-2026-21863
debian unimportant CVE-2026-21863 unimportant priority: Debian including 3 source packages (redict, redis, valkey), 10 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 10. https://security-tracker.debian.org/tracker/CVE-2026-21863
redhat high — https://access.redhat.com/security/cve/CVE-2026-21863
suse medium CVE-2026-21863 severity moderate: SUSE including 9 source package names (valkey-8.0.7-150600.13.20.1, valkey-8.0.7-150700.3.14.1, …), 9 product×package rows across 3 product lines (SUSE Linux Enterprise Module for Server Applications 15 SP7, openSUSE Leap 15.6, openSUSE Tumbleweed): Fixed 6, First Fixed 3. https://www.suse.com/security/cve/CVE-2026-21863/
ubuntu medium CVE-2026-21863 medium priority: Ubuntu including 1 source packages (valkey), 4 status rows across 4 suites (jammy, noble, questing, upstream): released 2, DNE 1, needs-triage 1. https://ubuntu.com/security/CVE-2026-21863

Affected software / configurations for CVE-2026-21863

Vendor Product Version Raw CPE
lfprojects valkey < 7.2.12 cpe:2.3:a:lfprojects:valkey:*:*:*:*:*:*:*:*
lfprojects valkey >= 8.0.0, < 8.0.7 cpe:2.3:a:lfprojects:valkey:*:*:*:*:*:*:*:*
lfprojects valkey >= 8.1.0, < 8.1.6 cpe:2.3:a:lfprojects:valkey:*:*:*:*:*:*:*:*
lfprojects valkey >= 9.0.0, < 9.0.2 cpe:2.3:a:lfprojects:valkey:*:*:*:*:*:*:*:*

References for CVE-2026-21863

cvelogic Threat Intelligence