Remote Code Execution Vulnerability in Valkey Cluster Publish Handler Affects In‑Memory Data Stores
What Happened — A newly disclosed vulnerability (ZDI‑26‑833 / CVE‑2026‑XXXX) in Valkey’s clusterCreatePublishMsgBlock function allows a remote, authenticated attacker to trigger a numeric‑truncation error that leads to buffer‑allocation mis‑calculation and arbitrary code execution in the service‑account context. The flaw resides in the handling of parameters supplied to the PUBLISH message handler; insufficient validation of user‑controlled data enables the exploit. Valkey has published a security advisory and released a patched version. No public exploitation has been reported to date.
Why It Matters for Trust & Control Assurance — The issue highlights the need for robust input‑validation controls and continuous evidence of patch management, a core control‑area that maps to many compliance frameworks.
Who Is Affected — Any organization that runs Valkey (or Redis‑compatible) clusters in production, including cloud‑infra providers, SaaS platforms, fintech services, gaming back‑ends, and other high‑performance data‑store environments.
Recommended Actions
- Apply the vendor‑provided patch immediately.
- Verify that all Valkey nodes are running the updated binary.
- Conduct a focused code‑review of custom
PUBLISH‑related extensions to ensure proper bounds checking. - Enable runtime monitoring for anomalous process behavior or unexpected child processes spawned by the Valkey service.
- Document the remediation steps as audit evidence for control‑mapping requirements.
Technical Notes
- CVSS 3.1 Base Score: 8.8 (High) – AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
- Exploit requires valid authentication but grants full code execution.
- Vulnerability stems from numeric truncation leading to buffer overflow in the publish‑message path.
- Advisory and patch: https://github.com/valkey-io/valkey/security/advisories/GHSA-f4q9-j22m-xqq9