CVE-2026-21863: Valkey Clusterbus DOS Vulnerability

CVE-2026-21863 Overview

CVE-2026-21863 is an out-of-bounds read vulnerability affecting Valkey, a distributed key-value database. A malicious actor with access to the Valkey clusterbus port can send a specially crafted invalid packet that triggers an out-of-bounds read operation, potentially causing the system to crash. The vulnerability exists because the clusterbus packet processing code fails to validate that a ping extension packet is located within the buffer boundaries of the clusterbus packet before attempting to read it.

Critical Impact

This vulnerability enables remote denial of service attacks against Valkey cluster deployments. Attackers with network access to the clusterbus port can crash affected systems without authentication, potentially disrupting distributed database operations and dependent applications.

Affected Products

• Valkey versions prior to 9.0.2
• Valkey versions prior to 8.1.6
• Valkey versions prior to 8.0.7
• Valkey versions prior to 7.2.12

Discovery Timeline

• 2026-02-23 - CVE-2026-21863 published to NVD
• 2026-02-25 - Last updated in NVD database

Technical Details for CVE-2026-21863

Vulnerability Analysis

This vulnerability is classified as CWE-125 (Out-of-Bounds Read), a memory corruption vulnerability that occurs when software reads data past the end or before the beginning of an intended buffer. In Valkey's case, the clusterbus component—responsible for inter-node communication in clustered deployments—lacks proper boundary validation when processing ping extension packets.

The attack can be executed remotely over the network without requiring any privileges or user interaction. While the vulnerability does not enable data exfiltration or code execution, it poses a significant availability risk. Successful exploitation results in system crashes, which can cascade across a Valkey cluster and disrupt database operations for dependent applications.

Root Cause

The root cause is insufficient input validation in the clusterbus packet processing code. When Valkey receives a clusterbus ping extension packet, the code attempts to read packet contents without first verifying that the extension data falls within the allocated buffer boundaries. This missing bounds check allows an attacker to craft packets that cause the server to read memory outside the designated buffer area.

Attack Vector

The attack requires network access to the Valkey clusterbus port. An attacker sends a malformed clusterbus packet containing a ping extension that references memory locations outside the valid buffer range. When Valkey processes this packet, it performs an out-of-bounds read operation. This memory access violation can cause the server process to crash, resulting in denial of service.

The attack is network-based and requires no authentication, making any exposed clusterbus port a potential target. The clusterbus port is typically used for internal cluster communication and should not be exposed to untrusted networks.

Detection Methods for CVE-2026-21863

Indicators of Compromise

• Unexpected Valkey server crashes or process terminations
• Segmentation fault errors in Valkey logs related to clusterbus operations
• Anomalous network traffic patterns targeting the clusterbus port
• Repeated connection attempts from unknown sources to cluster communication ports

Detection Strategies

• Monitor Valkey cluster nodes for unexpected process crashes or restarts
• Implement network intrusion detection rules to identify malformed clusterbus packets
• Set up alerting for segmentation faults or memory access violations in Valkey processes
• Track connection attempts to clusterbus ports from non-cluster IP addresses

Monitoring Recommendations

• Deploy network monitoring on clusterbus ports to detect suspicious traffic patterns
• Configure log aggregation to correlate crash events across cluster nodes
• Implement health checks that alert on repeated node failures within short time windows
• Review firewall logs for unauthorized access attempts to internal cluster ports

How to Mitigate CVE-2026-21863

Immediate Actions Required

• Upgrade Valkey to patched versions: 9.0.2, 8.1.6, 8.0.7, or 7.2.12
• Restrict network access to clusterbus ports using firewalls or network ACLs
• Ensure clusterbus ports are not exposed to untrusted networks or end users
• Implement network segmentation to isolate cluster communication traffic

Patch Information

The Valkey project has released security patches addressing this vulnerability. Users should upgrade to the following fixed versions based on their current deployment:

• Version 9.x: Upgrade to 9.0.2 or later
• Version 8.1.x: Upgrade to 8.1.6 or later
• Version 8.0.x: Upgrade to 8.0.7 or later
• Version 7.2.x: Upgrade to 7.2.12 or later

For complete details on the security fix, refer to the Valkey Security Advisory on GitHub.

Workarounds

• Implement network ACLs to restrict clusterbus port access to trusted cluster nodes only
• Place Valkey cluster nodes behind a firewall that blocks external access to cluster communication ports
• Use VPN or private network segments for inter-node cluster traffic
• Monitor and alert on any connection attempts to clusterbus ports from non-whitelisted IP addresses

# Example: Restrict clusterbus port access using iptables
# Allow only trusted cluster nodes to access the clusterbus port (default: 16379)
iptables -A INPUT -p tcp --dport 16379 -s <trusted_node_ip_1> -j ACCEPT
iptables -A INPUT -p tcp --dport 16379 -s <trusted_node_ip_2> -j ACCEPT
iptables -A INPUT -p tcp --dport 16379 -j DROP