PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-9054 Aerospike CVE debrief

CVE-2016-9054 is a critical network-reachable memory corruption flaw in Aerospike Database Server 3.10.0.3. According to the NVD record and the CVE description, a specially crafted packet can trigger a stack-based buffer overflow in the querying path, with potential remote code execution. Because the issue can be triggered by simply connecting to the service port, defenders should treat exposed Aerospike deployments as high priority for verification and remediation.

Vendor
Aerospike
Product
CVE-2016-9054
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-26
Original CVE updated
2026-05-13
Advisory published
2017-01-26
Advisory updated
2026-05-13

Who should care

Administrators and security teams responsible for Aerospike Database Server, especially any environment running version 3.10.0.3 or systems exposing the Aerospike service to untrusted networks. Incident responders should also care because the flaw is network-triggerable and impacts confidentiality, integrity, and availability.

Technical summary

NVD classifies the weakness as CWE-787 (out-of-bounds write) and assigns CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The vulnerability is described as a stack-based buffer overflow in the function as_sindex__simatch_list_by_set_binid during querying. The affected CPE in the record is Aerospike Database Server 3.10.0.3. The exposure condition is especially concerning because no privileges or user interaction are required to trigger the issue over the network.

Defensive priority

Immediate. The combination of network reachability, no authentication requirement, and potential remote code execution makes this a top-priority vulnerability for asset identification, exposure reduction, and version verification.

Recommended defensive actions

  • Identify all Aerospike Database Server instances and confirm whether version 3.10.0.3 is present.
  • Restrict network access to Aerospike service ports from untrusted networks until affected systems are verified safe.
  • Apply the vendor-provided remediation or upgrade path referenced in the official advisory and validate the resulting version.
  • Check for compensating controls such as segmentation, firewall rules, and service exposure limits on any internet-facing or partner-facing deployments.
  • Review logs and monitoring for unexpected connection attempts or anomalous query activity against Aerospike services.
  • If exposure is confirmed, treat the system as high risk and prioritize remediation before broader maintenance work.

Evidence notes

The CVE description states that an exploitable stack-based buffer overflow exists in Aerospike Database Server 3.10.0.3 and that a specially crafted packet can cause remote code execution. The NVD metadata lists the affected CPE as cpe:2.3:a:aerospike:database_server:3.10.0.3 and classifies the weakness as CWE-787. The CVSS vector in NVD is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, supporting a critical network-exploitable impact assessment. NVD references a Talos advisory, though one SecurityFocus reference is marked broken in the metadata.

Official resources

Publicly disclosed and published in the CVE record on 2017-01-26. The supplied source data also shows later metadata modification on 2026-05-13, which should not be confused with the original issue date.