Vulnerability · GHSA-f4q9-j22m-xqq9
Integer truncation in Valkey cluster publish message construction causes a heap buffer overflow
Published Oct 26, 2026 · catalog updated Oct 26, 2026 · Integer truncation in Valkey
Last checked Nov 1, 2026. A connected source was read within the last 7 days.
Open the advisory
Exploitation likelihood is not on this record for GHSA-f4q9-j22m-xqq9. A missing EPSS score is not a low risk. Compare Integer truncation in Valkey with the linked advisory before you change production.
Gaps on this record
- The stored product name is a package slug. The name on this page is taken from the title (Integer truncation in Valkey).
- No vendor fix or required action is stored. Compare the linked advisory before you change production.
- EPSS is missing. A missing score is not a low risk.
- Severity
- High8.8
- Known exploitation
- Not in CISA/VulnCheck KEV
- EPSS
- Awaiting synchronization with FIRST
- Remediation
- Version ranges on file
- Affected products
- other valkey-server
## Impact An authenticated user who can publish to a channel on a server running in cluster mode can make the server allocate a heap buffer far smaller than the message it is about to copy into it, and then write past the end of that buffer with attacker-controlled bytes. This reliably crashes the server process, and because the overflowing bytes are chosen by the attacker, it may be possible to escalate it to remote code execution running as the user the server runs as. This issue affects Valkey 7.2, 8.0, 8.1, 9.0, 9.1 and 9.2 running in cluster mode. Servers that do not have cluster mode enabled are not affected. ## Details When a node propagates a or to the rest of the cluster, in ( on 7.2) computes the length of the cluster bus message as a , but passes it to , which takes a . When the channel and message together exceed , the length is silently truncated and a buffer far smaller than the message is allocated. The two calls that follow copy the full channel and message into it. Both the regular and the light cluster bus header paths are affected, as are the module publish APIs. Building a channel and message this large requires more than 4 GiB of memory. With the default of 512 MB, a client cannot send arguments that large directly, but a script can construct them on the server. The cluster bus cannot represent a message of this size, so the fix validates the complete serialized length before any 32-bit conversion or allocation. and now reply with an error, and the message is neither published locally nor propagated. ## Mitigation You can mitigate this issue by using Valkey ACLs to restrict the scripting commands ( , , , , , and ) if your application does not intend to use them, and by not raising above its default. ## Credits The defect was reported by Nenad Stojanovski working with Trend Micro Zero Day Initiative (ZDI-CAN-28318). The fix was authored by https://github.com/roshkhatri (#5030).
Are you affected?
Enter the version you run. The result uses only the ranges stored on this record.
The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.
- other valkey-server<= 9.2.0-rc1, <= 9.1.2, <= 9.0.6, <= 8.1.10, <= 8.0.11, <= 7.2.14
How to fix GHSA-f4q9-j22m-xqq9
Upgrade
GHSA-f4q9-j22m-xqq9 lists a fix boundary at 9.2.0-rc1. Compare the installed build with that boundary before you change production.
Version check
Affected <= 9.2.0-rc1
Advisory
Open the inventory_github record and follow its fix.
Official advisories
What to do
Three questions, each answered from this record only. Confirm the vendor advisory before you patch.
Should you patch?
Exploitation likelihood is not on this record for GHSA-f4q9-j22m-xqq9. A missing EPSS score is not a low risk. Compare Integer truncation in Valkey with the linked advisory before you change production.
Which versions are affected?
Compare what you have installed with <= 9.2.0-rc1, <= 9.1.2, <= 9.0.6, <= 8.1.10, <= 8.0.11, <= 7.2.14. Compare the installed version with the linked vendor advisory before you change production.
What should an analyst verify?
No weakness class is stored. EPSS is not on this record yet. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.
Technology hubs
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Oct 26, 2026 · Maintainer security tabs
Detected
## Impact An authenticated user who can publish to a channel on a server running in cluster mode can make the server allocate a heap buffer far smaller than the message it is about to copy into it, and then write past the end of that buffer with attacker-controlled bytes. This reliably crashes the server process, and because the overflowing bytes are chosen by the attacker, it may be possible to e
Oct 26, 2026 · Maintainer security tabs
Updated
## Impact An authenticated user who can publish to a channel on a server running in cluster mode can make the server allocate a heap buffer far smaller than the message it is about to copy into it, and then write past the end of that buffer with attacker-controlled bytes. This reliably crashes the server process, and because the overflowing bytes are chosen by the attacker, it may be possible to e
Sources
- Maintainer security tabsVendor advisoryGHSA-f4q9-j22m-xqq9
## Impact An authenticated user who can publish to a channel on a server running in cluster mode can make the server allocate a heap buffer far smaller than the message it is about to copy into it, and then write past the end of that buffer with attacker-controlled bytes. This reliably crashes the server process, and because the overflowing bytes are chosen by the attacker, it may be possible to e
github.com
Freshness
Last verified in this catalog Oct 26, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.
- Maintainer security tabsNov 1, 2026