Description

A vulnerability was detected in valkey-io valkey up to 9.5.4/9.1.0. Affected by this vulnerability is the function createSlotImportJob of the file src/cluster_migrateslots.c of the component Slot Migration. The manipulation of the argument job_name results in out-of-bounds read. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version 9.0.5 and 9.1.1 addresses this issue. The patch is identified as f4dc3ca09eb650c2fe14060090a41c524eca803f. Upgrading the affected component is advised.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-04T14:17:22.807Z",
  "pubdate": "2026-09-04T14:17:22.807Z",
  "executiveSummary": "A critical out-of-bounds read vulnerability exists in the Slot Migration component of Valkey, specifically within the createSlotImportJob function.\nThe vulnerability originates from improper handling of the job_name argument, allowing for memory access violations.\nThis flaw affects Valkey versions up to 9.0.4 and 9.1.0.\nThe vulnerability is remotely exploitable, posing a significant risk as public exploit code is currently available.\nSuccessful exploitation may lead to unauthorized disclosure of sensitive memory contents, potentially facilitating further attacks or system instability.\nImmediate remediation by upgrading to the secured versions is necessary to neutralize the exposure.",
  "technicalDetails": "The vulnerability is located in the src/cluster_migrateslots.c file within the createSlotImportJob function, which manages slot migration jobs in the Valkey clustering architecture.\nThe root cause is an out-of-bounds read triggered by unsanitized input processed through the job_name argument. When the function handles this argument, it fails to perform adequate bounds checking, leading the application to read memory addresses outside the allocated buffer boundaries.\nThe attack flow involves a remote adversary supplying a crafted job_name input during the slot migration initialization process. Because the function does not validate the length or content of the provided string against the destination buffer, the system attempts to access contiguous memory locations beyond the intended scope.\nExploitation allows the attacker to read potentially sensitive data residing in the process memory space. Depending on the memory layout and the specific data adjacent to the target buffer, this could result in the leakage of internal system state, configuration data, or other sensitive information processed by the Valkey node.\nThe exploit is accessible remotely, meaning an attacker does not necessarily require local filesystem access to trigger the condition. Once the malformed input is processed by the vulnerable createSlotImportJob function, the out-of-bounds read occurs synchronously.\nThe post-exploitation impact is primarily centered on information disclosure. By repeatedly leveraging this flaw, an attacker could potentially extract disparate segments of memory, aiding in the bypass of security mitigations like ASLR if further vulnerabilities are chained.\nThe flaw is addressed in the upstream patch identified by commit hash f4dc3ca09eb650c2fe14060090a41c524eca803f, which corrects the handling of the job_name argument to enforce strict bounds validation before memory access occurs."
}