Skip to content
OpenAdvisories
High ELSA-2025-21936 4 CVEs

Important: valkey security update (Oracle Linux 10)

Published Dec 2, 2025 · Updated Dec 2, 2025

Ecosystem: Oracle Linux

Summary

[8.0.6-2]
- rebase to 8.0.6 for CVE-2025-49844 CVE-2025-46817 CVE-2025-46818 CVE-2025-46819

[8.0.4-3]
- fix ImageMode: ensure ownership of /etc/valkey

[8.0.4-2]
- fix ImageMode: add tmpfiles.d entries for directories below /var

[8.0.4-1]
- rebase to 8.0.4 for CVE-2025-27151 CVE-2025-48367 and CVE-2025-32023

[8.0.3.1]
- rebase to 8.0.3

[8.0.2.1]
- rebase to 8.0.2
Resolves: RHEL-73273

[7.2.6-2]
- Bump release for October 2024 mass rebuild:
Resolves: RHEL-64018

[7.2.6.1]
- rebase to 7.2.6
- merge limit.conf in main service files
- drop /etc/sysconfig/valkey
- rename compat package
- fix working dir
- partially enable upstream test suite

[7.2.5-4]
- Bump release for June 2024 mass rebuild

[7.2.5-3]
- remove version_no_tilde code

Fixed packages 2

ReleasePackageFixed in
Oracle Linux · 10 valkey 0:8.0.6-2.el10_1
Oracle Linux · 10 valkey-devel 0:8.0.6-2.el10_1

Vulnerabilities 4

  • Critical 10.0
    CVE-2025-49844 Public exploit Scanner template EPSS 83%

    Redis Lua Use-After-Free may lead to remote code execution

    Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code exe…

    Redis Redis redis redis Debian Ubuntu Azure Linux Alpine
  • High 7.0
    CVE-2025-46817 Public exploit Scanner template

    Lua library commands may lead to integer overflow and potential RCE

    Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to cause an integer overflow and potentially lead to remote code execution The problem exists in all …

    Redis Redis redis redis Debian Ubuntu Azure Linux Alpine
  • Medium 6.3
    CVE-2025-46819 Public exploit Scanner template

    Redis is vulnerable to DoS via specially crafted LUA scripts

    Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted LUA script to read out-of-bound data or crash the server and subsequent denial of service. The problem exists in…

    Redis Redis redis redis Debian Ubuntu Azure Linux Alpine
  • Medium 6.0
    CVE-2025-46818 Public exploit Scanner template

    Redis: Authenticated users can execute LUA scripts as a different user

    Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate different LUA objects and potentially run their own code in the context of another user…

    Redis Redis redis redis Debian Ubuntu Azure Linux Alpine