PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-9050 Aerospike CVE debrief

CVE-2016-9050 affects Aerospike Database Server 3.10.0.3. According to the NVD record, a specially crafted network packet can trigger an out-of-bounds read in client message parsing, which may disclose memory from the process and can also cause a denial of service. The issue is network reachable and does not require privileges or user interaction.

Vendor
Aerospike
Product
CVE-2016-9050
CVSS
HIGH 8.2
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-26
Original CVE updated
2026-05-13
Advisory published
2017-01-26
Advisory updated
2026-05-13

Who should care

Security, SRE, and platform teams operating Aerospike Database Server 3.10.0.3, especially if the database port is reachable from untrusted or broadly accessible networks.

Technical summary

NVD maps this issue to CWE-125 (out-of-bounds read). The vulnerable path is client message parsing: a crafted packet can cause the server to read past the intended buffer bounds. The supplied CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H, which matches a remotely reachable issue with memory disclosure risk and a high availability impact from crashes or service interruption.

Defensive priority

High. This is a remotely exploitable, unauthenticated network issue with both confidentiality and availability impact, so exposed deployments should be treated as urgent remediation candidates.

Recommended defensive actions

  • Inventory Aerospike Database Server deployments and confirm whether version 3.10.0.3 is in use.
  • Apply the vendor's supported update or remediation guidance for CVE-2016-9050 as soon as possible.
  • Restrict network access to the Aerospike service port so only trusted hosts and subnets can connect.
  • Monitor for abnormal client connections, unexpected server crashes, and other signs of parser-triggered instability.
  • If immediate patching is not possible, place compensating controls around the exposed service and reduce attack surface until remediation is complete.

Evidence notes

This debrief is based on the supplied NVD CVE record and official CVE record link. The NVD metadata identifies Aerospike Database Server 3.10.0.3 as vulnerable, classifies the weakness as CWE-125, and lists a CVSS v3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H. The NVD references include a SecurityFocus BID entry and a Talos advisory URL, both marked in the metadata as legacy/broken references. No CISA KEV entry was provided in the source corpus.

Official resources

Publicly published on 2017-01-26 and last modified in the supplied NVD record on 2026-05-13. The source corpus does not indicate KEV inclusion.