CVE-2026-85522

[CVE catalog]

Severity

High · CVSS 8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Published

Aug 18, 2026, 3:16:55 PM UTC

Updated

Sep 4, 2026, 2:17:22 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.86% · Oct 25, 2026

A flaw was found in the Slot Migration component of Valkey. A remote attacker can exploit an out-of-bounds read vulnerability in the `createSlotImportJob` function by manipulating the `job_name` argument. This can lead to a denial of service, making the affected system unavailable. valkey: Valkey: Remote out-of-bounds read in Slot Migration can lead to denial of service An out-of-bounds read vulnerability was found in Valkey's Slot Migration component within the createSlotImportJob function in src/cluster_migrateslots.c. A remote attacker can trigger this flaw by manipulating the job_name argument during slot migration operations. Under default Red Hat configurations, this out-of-bounds memory read triggers a segmentation fault that crashes the Valkey daemon, resulting in a denial of service. The process is constrained by the unprivileged valkey service account and standard SELinux policies, preventing arbitrary code execution or host-level compromise. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.