CVE-2026-21863
📋 TL;DR
This vulnerability in Valkey allows attackers with access to the clusterbus port to send specially crafted packets that cause out-of-bounds reads, potentially leading to system crashes. It affects all Valkey deployments with exposed clusterbus connections. The issue is fixed in specific patched versions.
💻 Affected Systems
- Valkey
📦 What is this software?
Valkey by Lfprojects
Valkey by Lfprojects
Valkey by Lfprojects
Valkey by Lfprojects
⚠️ Risk & Real-World Impact
Worst Case
Complete denial of service through system crash, potentially disrupting all Valkey services and dependent applications.
Likely Case
Service disruption and downtime due to Valkey process crashes, requiring manual restart.
If Mitigated
Minimal impact if clusterbus is properly isolated and network controls are implemented.
🎯 Exploit Status
Exploitation requires network access to clusterbus port but no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 9.0.2, 8.1.6, 8.0.7, or 7.2.12
Vendor Advisory: https://github.com/valkey-io/valkey/security/advisories/GHSA-c677-q3wr-gggq
Restart Required: Yes
Instructions:
1. Identify current Valkey version. 2. Upgrade to appropriate patched version based on your major version. 3. Restart Valkey services. 4. Verify the new version is running.
🔧 Temporary Workarounds
Network Isolation
linuxRestrict access to Valkey clusterbus port using firewall rules or network ACLs
iptables -A INPUT -p tcp --dport 16379 -j DROP
ufw deny 16379
🧯 If You Can't Patch
- Implement strict network segmentation to isolate clusterbus traffic to trusted nodes only
- Deploy network monitoring and intrusion detection for suspicious clusterbus traffic
🔍 How to Verify
Check if Vulnerable:
Check if Valkey version is below 9.0.2, 8.1.6, 8.0.7, or 7.2.12 and clusterbus port is accessibleCheck Version:
redis-cli --version | grep -o 'valkey [0-9.]*'Verify Fix Applied:
Confirm Valkey version is 9.0.2, 8.1.6, 8.0.7, or 7.2.12 or higher📡 Detection & Monitoring
Log Indicators:
- Valkey process crashes
- Segmentation fault errors in system logs
- Cluster connection failures
Network Indicators:
- Unusual traffic to clusterbus port (default 16379)
- Malformed packets to clusterbus
SIEM Query:
source="valkey.log" AND ("segmentation fault" OR "crash" OR "clusterbus")