Skip to content
OpenAdvisories
High ALAS2023-2025-1067 2 CVEs

Important: valkey security update (Amazon Linux 2023)

Published Jul 3, 2025 · Updated Jul 10, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-48367: Redis and Valkey contain a defect such that a well constructed hyperloglog can corrupt arbitrary memory on the heap, which could lead to remote code execution. CVE-2025-32023: Redis and Valkey contain a defect such that a well constructed hyperloglog can corrupt arbitrary memory on the heap, which could lead to remote code execution.

Fixed packages 4

ReleasePackageFixed in
Amazon Linux · 2023 valkey 0:8.0.3-3.amzn2023.0.4
Amazon Linux · 2023 valkey-debuginfo 0:8.0.3-3.amzn2023.0.4
Amazon Linux · 2023 valkey-debugsource 0:8.0.3-3.amzn2023.0.4
Amazon Linux · 2023 valkey-devel 0:8.0.3-3.amzn2023.0.4

Vulnerabilities 2

  • High 7.5
    CVE-2025-48367

    Redis DoS Vulnerability due to bad connection error handling

    Redis is an open source, in-memory database that persists on disk. An unauthenticated connection can cause repeated IP protocol errors, leading to client starvation and, ultimately, a denial of service. This vulnerability is fixed in 8.0.3, 7.4.5, 7.2.10, and…

    Redis Redis redis redis Debian Ubuntu Azure Linux Alpine
  • High 7.0
    CVE-2025-32023 Public exploit

    Redis allows out of bounds writes in hyperloglog commands leading to RCE

    Redis is an open source, in-memory database that persists on disk. From 2.8 to before 8.0.3, 7.4.5, 7.2.10, and 6.2.19, an authenticated user may use a specially crafted string to trigger a stack/heap out of bounds write on hyperloglog operations, potentially…

    Redis Redis redis redis Debian Ubuntu Azure Linux Alpine

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-32023.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-48367.html