CVE-2026-27623: Lfprojects Valkey DoS Vulnerability

CVE-2026-27623 Overview

CVE-2026-27623 is a high-severity denial of service vulnerability in Valkey, a distributed key-value database. The vulnerability affects Valkey versions starting from 9.0.0 and prior to 9.0.3. A malicious actor with network access to a Valkey instance can trigger an assertion failure that causes the system to abort, resulting in service disruption.

The flaw exists in how Valkey processes incoming requests. When the system handles an empty request, it fails to properly reset the networking state. An attacker can subsequently send a crafted request that the server incorrectly identifies as breaking server-side invariants, causing the server to shut down unexpectedly.

Critical Impact

Remote attackers with network access can crash Valkey instances without authentication, leading to denial of service for all dependent applications and data unavailability.

Affected Products

• Valkey versions 9.0.0 through 9.0.2
• lfprojects Valkey distributed key-value database
• Deployments with network-accessible Valkey instances

Discovery Timeline

• 2026-02-23 - CVE-2026-27623 published to NVD
• 2026-02-25 - Last updated in NVD database

Technical Details for CVE-2026-27623

Vulnerability Analysis

This vulnerability is classified as Improper Input Validation (CWE-20). The core issue lies in Valkey's request processing pipeline, where the networking state machine fails to reset properly after handling edge cases such as empty requests. This creates a condition where subsequent requests can trigger assertion failures designed to protect server-side invariants.

The attack can be executed remotely over the network without requiring any privileges or user interaction. While the vulnerability does not allow for data exfiltration or integrity compromise, it enables complete service disruption. This makes it particularly dangerous for production deployments where Valkey serves as a critical caching or session storage layer.

Root Cause

The root cause stems from improper state management in the networking layer. When Valkey receives an empty request, the internal state machine does not correctly transition back to a clean state. This leaves residual state information that corrupts the processing context for subsequent requests. When the next request arrives, server-side validation logic detects what appears to be an invariant violation, triggering a defensive assertion that terminates the process.

Attack Vector

The attack requires network access to the Valkey service. An attacker can exploit this vulnerability by sending a sequence of specially crafted requests:

1. The attacker establishes a network connection to the target Valkey instance
2. An empty request is sent to corrupt the internal networking state
3. A follow-up request is sent that triggers the assertion failure
4. The Valkey server terminates, causing denial of service

The attack does not require authentication or any special privileges. Any network-accessible Valkey deployment running affected versions is vulnerable. The vulnerability is particularly impactful in environments where Valkey is exposed without proper network isolation, as attackers can repeatedly crash the service, preventing recovery.

Detection Methods for CVE-2026-27623

Indicators of Compromise

• Unexpected Valkey process termination or crash events in system logs
• Assertion failure messages in Valkey logs related to networking state
• Patterns of empty or malformed requests followed by service crashes
• Repeated service restarts without apparent resource exhaustion

Detection Strategies

• Monitor Valkey process stability and implement alerting on unexpected restarts
• Analyze network traffic for sequences of empty requests followed by abnormal connections
• Deploy application-level logging to capture request patterns before crash events
• Implement health checks that detect service unavailability patterns

Monitoring Recommendations

• Configure centralized logging to aggregate Valkey crash dumps and assertion failures
• Set up real-time alerting for Valkey service interruptions and restart loops
• Monitor network connections for anomalous patterns targeting Valkey ports
• Track request metrics to identify sudden drops that may indicate exploitation attempts

How to Mitigate CVE-2026-27623

Immediate Actions Required

• Upgrade Valkey to version 9.0.3 or later immediately
• Isolate Valkey deployments to ensure only trusted users have network access
• Implement network segmentation to restrict access to Valkey instances
• Review firewall rules to limit exposure of Valkey services

Patch Information

The vulnerability has been fixed in Valkey version 9.0.3. Organizations should prioritize upgrading to this version or later. The fix addresses the improper state reset in the networking layer, ensuring that the system correctly handles empty requests without corrupting subsequent request processing.

For detailed patch information and security advisories, refer to the Valkey GitHub Security Advisory.

Workarounds

• Implement strict network access controls to limit connectivity to Valkey instances from trusted sources only
• Deploy Valkey behind a reverse proxy or firewall that can filter malformed requests
• Use authentication mechanisms if available to restrict access to authorized clients
• Consider temporary service isolation until patches can be applied in production environments

# Example: Restrict Valkey access using iptables
# Allow only trusted internal network (adjust CIDR as needed)
iptables -A INPUT -p tcp --dport 6379 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 6379 -j DROP