Valkey numeric truncation bug allows authenticated remote code execution
Original title: ZDI-26-833: Valkey clusterCreatePublishMsgBlock Numeric Truncation Error Remote Code Execution Vulnerability
ZDI rates ZDI-26-833 at CVSS 8.8; an authenticated attacker can run arbitrary code on Valkey.
ZDI published ZDI-26-833, a numeric truncation error in Valkey's clusterCreatePublishMsgBlock function. Remote attackers who are already authenticated can execute arbitrary code on affected installations. The advisory assigns CVSS 8.8 and does not name a CVE, versions, or a fix.
Unconfirmed: No CVE, versions, patch, or exploitation status is stated.
- Authentication is required before the flaw can be exploited.
- ZDI assigned a CVSS rating of 8.8.
- No affected or fixed versions are stated.
Impact: authenticated remote arbitrary code execution
| Product | Affected |
|---|---|
| Valkey | — |
- Vendors
- Valkey
- Organizations
- Zero Day Initiative
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Valkey. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.