DEBIAN-CVE-2026-85522
A vulnerability was detected in valkey-io valkey up to 9.5.4/9.1.0. Affected by this vulnerability is the function createSlotImportJob of the file src/cluster_migrateslots.c of the component Slot Migration. The manipulation of the argument job_name results in out-of-bounds read. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version 9.0.5 and 9.1.1 addresses this issue. The patch is identified as f4dc3ca09eb650c2fe14060090a41c524eca803f. Upgrading the affected component is advised.
DEBIAN-CVE-2026-85522
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:DEBIAN-CVE-2026-85522
valkey
Source reference: /affected/0/package/name
- Affected versions
- 8.1.1+dfsg1-3
Source reference:
/affected/0/versions8.1.4+dfsg1-1Source reference:
/affected/0/versions8.1.4+dfsg1-2Source reference:
/affected/0/versions9.1.1-1Source reference:
/affected/0/versions - Fixed versions
- 9.1.2-1
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "9.1.2-1"
}
]
}
],
"package": {
"name": "valkey",
"purl": "pkg:deb/debian/valkey?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"8.1.1+dfsg1-3",
"8.1.4+dfsg1-1",
"8.1.4+dfsg1-2",
"9.1.1-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-85522.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #58216 · Revision 1
- Added to Heist Feed
- Publisher date