Skip to content
OpenAdvisories
High ELSA-2026-3443 2 CVEs

Important: valkey security update (Oracle Linux 10)

Published Feb 26, 2026 · Updated Feb 26, 2026

Ecosystem: Oracle Linux

Summary

[8.0.7-1]
- Rebase to 8.0.7 for CVE-2026-21863 CVE-2025-67733

Fixed packages 2

ReleasePackageFixed in
Oracle Linux · 10 valkey 0:8.0.7-1.el10_1
Oracle Linux · 10 valkey-devel 0:8.0.7-1.el10_1

Vulnerabilities 2

  • High 8.5
    CVE-2025-67733 Public exploit

    Valkey Affected by RESP Protocol Injection via Lua error_reply

    Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious user can use scripting commands to inject arbitrary information into the response stream for the given client, potentially corrupting or returning tampe…

    valkey-io valkey redis valkey Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2026-21863

    Malformed Valkey Cluster bus message can lead to Remote DoS

    Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious actor with access to the Valkey clusterbus port can send an invalid packet that may cause an out bound read, which might result in the system crashing. …

    valkey-io valkey redis valkey Debian Ubuntu Azure Linux Alpine