Is CVE-2026-21863 actively exploited?

CVE-2026-21863 has no public evidence of in-the-wild exploitation as of 2026-02-25.

What is the CVSS score for CVE-2026-21863?

CVE-2026-21863 has a CVSS score of 7.5 (HIGH severity). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

How do I patch CVE-2026-21863?

Patch guidance is available from lfprojects security advisories. CVEDatabase generates AI-assisted remediation guidance on demand for CVE-2026-21863.

Fix CVE-2026-21863 - HIGH lfprojects valkey

Q: Which products are affected by CVE-2026-21863?

4 products: lfprojects valkey, lfprojects valkey, lfprojects valkey, lfprojects valkey.

Description

Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious actor with access to the Valkey clusterbus port can send an invalid packet that may cause an out bound read, which might result in the system crashing. The Valkey clusterbus packet processing code does not validate that a clusterbus ping extension packet is located within buffer of the clusterbus packet before attempting to read it. Versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12 fix the issue. As an additional mitigation, don't expose the cluster bus connection directly to end users, and protect the connection with its own network ACLs.

CVSS Metrics

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector: network
Complexity: low
Privileges: none
User Action: none
Scope: unchanged
Confidentiality: none
Integrity: none
Availability: high
Weaknesses: CWE-125 · Out-of-bounds Read

Metadata

Primary Vendor: LFPROJECTS
Published: 2/23/2026
Last Modified: 2/25/2026
Source: NIST NVD
Note: Verify all details with official vendor sources before applying patches.

Affected Products

lfprojects : valkeylfprojects : valkeylfprojects : valkeylfprojects : valkey

Remediation Guidance

Executive Summary

Cite this page

CVE-2026-21863. CVEDatabase.com. Retrieved 1 May 2026. https://cvedatabase.com/cve/CVE-2026-21863

View on NIST NVD

CVE-2026-21863 vulnerability