CVE-2026-27623 valkey-io CVE debrief

Who should care

Organizations using Valkey versions 9.0.0 to 9.0.2 should be concerned about this vulnerability. The issue allows a malicious actor with network access to cause the system to shut down, potentially leading to denial-of-service attacks. Users of Valkey should update to version 9.0.3 or apply additional mitigations to prevent exploitation.

Technical summary

The vulnerability in Valkey arises from the improper resetting of networking state after processing an empty request. This allows a malicious actor to send a crafted request that the server incorrectly identifies as a threat to server-side invariants, causing the server to shut down. The issue is addressed in Valkey version 9.0.3. The CVSS score for this vulnerability is 7.5, indicating a HIGH severity level. The attack vector is network-based, with low attack complexity and no required privileges or user interaction.

Defensive priority

High priority should be given to updating Valkey to version 9.0.3. Additionally, consider isolating Valkey deployments to limit access to trusted users only.

Recommended defensive actions

• Update Valkey to version 9.0.3 or later.
• Isolate Valkey deployments to restrict access to trusted users.
• Monitor Valkey instances for unusual activity.
• Review and adjust network access controls to limit exposure.
• Consider implementing additional security measures to detect and prevent similar attacks.

Evidence notes

The CVE-2026-27623 vulnerability is documented in the NVD database and has a CVSS score of 7.5. The issue is caused by the improper handling of empty requests in Valkey versions 9.0.0 to 9.0.2. The vulnerability can be exploited by a malicious actor with network access, potentially leading to a denial-of-service attack. The fix is included in Valkey version 9.0.3.

Official resources