Skip to content
OpenAdvisories
High ALSA-2026:3507 3 CVEs

Important: valkey security update

Published Mar 2, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set. In order to achieve its outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log. Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth. Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave like a cache. You can use Valkey from most programming languages also.

Security Fix(es):

* Valkey: Valkey: Data tampering and denial of service via improper null character handling in Lua scripts (CVE-2025-67733)
* valkey: Valkey: Denial of Service via invalid clusterbus packet (CVE-2026-21863)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 2

ReleasePackageFixed in
AlmaLinux · 9 valkey 8.0.7-1.el9_7
AlmaLinux · 9 valkey-devel 8.0.7-1.el9_7

Vulnerabilities 3

  • High 8.5
    CVE-2025-67733 Public exploit

    Valkey Affected by RESP Protocol Injection via Lua error_reply

    Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious user can use scripting commands to inject arbitrary information into the response stream for the given client, potentially corrupting or returning tampe…

    valkey-io valkey redis valkey Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2026-21863

    Malformed Valkey Cluster bus message can lead to Remote DoS

    Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious actor with access to the Valkey clusterbus port can send an invalid packet that may cause an out bound read, which might result in the system crashing. …

    valkey-io valkey redis valkey Debian Ubuntu Azure Linux Alpine
  • High 7.1
    CVE-2026-92925

    Redis: redis: out-of-bounds read via crafted cluster bus packets

    A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-carrying extensions for null-termination. This oversight allows a remote attacker to craft a malicious…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 10 Linux Debian Ubuntu

References

  • report
    https://access.redhat.com/security/cve/CVE-2025-67733
  • report
    https://access.redhat.com/security/cve/CVE-2026-21863
  • report
    https://bugzilla.redhat.com/2442025
  • report
    https://bugzilla.redhat.com/2442026
  • advisory
    https://errata.almalinux.org/9/ALSA-2026-3507.html
  • report
    https://www.redhat.com/security/data/cve/CVE-2026-92925.html