PT-2026-21548 · Valkey+1 · Valkey+1

Eliyacohen-Hub · Published 2026-02-23 · Updated 2026-04-30 · CVE-2026-27623

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Valkey versions 9.0.0 through 9.0.2

Description Valkey, a distributed key-value database, is susceptible to a denial of service condition. A remote attacker with network access can cause the system to terminate by triggering an assertion. This occurs because the system fails to reset networking state after processing an empty request, allowing a crafted request to be misinterpreted as a violation of server-side invariants, leading to a shutdown. As an additional mitigation, deployments should be properly isolated to restrict access to trusted users.

Recommendations Update to version 9.0.3 or later. Isolate Valkey deployments to limit network access to trusted users.

Exploit

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2026-07362

BIT-VALKEY-2026-27623

CVE-2026-27623

GHSA-93P9-5VC7-8WGR

OPENSUSE-SU-2026:10266-1

Affected Products

Red Os

Valkey

References · 22

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27623.json · Exploit
• https://github.com/valkey-io/valkey/security/advisories/GHSA-93p9-5vc7-8wgr · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-27623 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27623 · Security Note
• https://osv.dev/vulnerability/CVE-2026-27623 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10266-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-07362 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-27623 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-27623 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2026-27623 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-valkey-2026-27623 · Vendor Advisory
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-valkey-cve-2026-27623-8.0 · Note
• https://suse.com/security/cve/CVE-2025-67733 · Note
• https://suse.com/security/cve/CVE-2026-21863 · Note
• https://twitter.com/cracbot/status/2027700396861600031 · Twitter Post