Vulnerability Spotlight: Multiple Vulnerabilities in the Aerospike NoSQL Database Server
Summary: Cisco Talos disclosed multiple vulnerabilities in the Aerospike Database Server, ranging from denial of service to potential remote code execution, and addressed them in version 3.11.1.1. The flaws include CVE-2016-9049, a null-pointer dereference in the fabric-worker component triggered by a crafted packet over a TCP port, and CVE-2016-9051 and CVE-2016-9053, out-of-bounds write and indexing issues that an attacker can trigger by connecting to the listening port and sending a crafted packet.
What you should know: Two of these flaws reach remote code execution through nothing more than a connection to the listening port and a crafted packet, so any Aerospike instance below 3.11.1.1 that is reachable on the network is exposed to an unauthenticated attacker.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2016-9049CVE-2016-9051CVE-2016-9053
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026