PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-9050 Aerospike CVE debrief

CVE-2016-9050 affects Aerospike Database Server 3.10.0.3. According to the NVD record, a specially crafted network packet can trigger an out-of-bounds read in client message parsing, which may disclose memory from the process and can also cause a denial of service. The issue is network reachable and does not require privileges or user interaction.

Vendor
Aerospike
Product
Database Server
CVSS
HIGH 8.2
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-26
Original CVE updated
2026-05-13
Advisory published
2017-01-26
Advisory updated
2026-05-13

Who should care

Security, SRE, and platform teams operating Aerospike Database Server 3.10.0.3, especially if the database port is reachable from untrusted or broadly accessible networks.

Technical summary

NVD maps this issue to CWE-125 (out-of-bounds read). The vulnerable path is client message parsing: a crafted packet can cause the server to read past the intended buffer bounds. The supplied CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H, which matches a remotely reachable issue with memory disclosure risk and a high availability impact from crashes or service interruption.

Defensive priority

High. This is a remotely exploitable, unauthenticated network issue with both confidentiality and availability impact, so exposed deployments should be treated as urgent remediation candidates.

Recommended defensive actions

  • Inventory Aerospike Database Server deployments and confirm whether version 3.10.0.3 is in use.
  • Apply the vendor's supported update or remediation guidance for CVE-2016-9050 as soon as possible.
  • Restrict network access to the Aerospike service port so only trusted hosts and subnets can connect.
  • Monitor for abnormal client connections, unexpected server crashes, and other signs of parser-triggered instability.
  • If immediate patching is not possible, place compensating controls around the exposed service and reduce attack surface until remediation is complete.

Evidence notes

This debrief is based on the supplied NVD CVE record and official CVE record link. The NVD metadata identifies Aerospike Database Server 3.10.0.3 as vulnerable, classifies the weakness as CWE-125, and lists a CVSS v3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H. The NVD references include a SecurityFocus BID entry and a Talos advisory URL, both marked in the metadata as legacy/broken references. No CISA KEV entry was provided in the source corpus.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-9050 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-9050

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-9050 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-9050

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.