Is CVE-2026-27623 actively exploited?

CVE-2026-27623 has no public evidence of in-the-wild exploitation as of 2026-02-25.

What is the CVSS score for CVE-2026-27623?

CVE-2026-27623 has a CVSS score of 7.5 (HIGH severity). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

How do I patch CVE-2026-27623?

Patch guidance is available from lfprojects security advisories. CVEDatabase generates AI-assisted remediation guidance on demand for CVE-2026-27623.

Fix CVE-2026-27623 - HIGH lfprojects valkey

Description

Valkey is a distributed key-value database. Starting in version 9.0.0 and prior to version 9.0.3, a malicious actor with network access to Valkey can cause the system to abort by triggering an assertion. When processing incoming requests, the Valkey system does not properly reset the networking state after processing an empty request. A malicious actor can then send a request that the server incorrectly identifies as breaking server side invariants, which results in the server shutting down. Version 9.0.3 fixes the issue. As an additional mitigation, properly isolate Valkey deployments so that only trusted users have access.

CVSS Metrics

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector: network
Complexity: low
Privileges: none
User Action: none
Scope: unchanged
Confidentiality: none
Integrity: none
Availability: high
Weaknesses: CWE-20 · Improper Input Validation

Metadata

Primary Vendor: LFPROJECTS
Published: 2/23/2026
Last Modified: 2/25/2026
Source: NIST NVD
Note: Verify all details with official vendor sources before applying patches.

Affected Products

lfprojects : valkey

Remediation Guidance

Executive Summary

Cite this page

CVE-2026-27623. CVEDatabase.com. Retrieved 1 May 2026. https://cvedatabase.com/cve/CVE-2026-27623

View on NIST NVD

CVE-2026-27623 vulnerability