Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Fixed packages 6

Vulnerabilities 6

• High 8.8
  CVE-2026-63639

  Valkey: UAF in stream deserialization may lead to remote code execution

  Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deseriali…

  valkey-io valkey valkey valkey Debian Ubuntu Azure Linux Alpine
  Aug 18, 2026
• High 7.5
  CVE-2026-56684

  Valkey: TLS pending-data processing use-after-free may allow remote code execution

  Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's tlsProcessPendingData function iterates pending_list while an authenticated client can trigger CLIENT KILL, causing connTLSClose to delete the iterator's ca…

  valkey-io valkey valkey valkey Debian Ubuntu Azure Linux Alpine
  Aug 18, 2026
• Medium 5.3
  CVE-2026-85522

  valkey-io valkey Slot Migration cluster_migrateslots.c createSlotImportJob out-of-bounds

  A vulnerability was detected in valkey-io valkey up to 9.5.4/9.1.0. Affected by this vulnerability is the function createSlotImportJob of the file src/cluster_migrateslots.c of the component Slot Migration. The manipulation of the argument job_name results in…

  valkey-io valkey valkey valkey Debian Ubuntu
  Sep 4, 2026
• Low 3.1
  CVE-2026-86227

  valkey-io valkey kvstore.c kvstoreGetHashtable out-of-bounds

  A weakness has been identified in valkey-io valkey up to 9.0.5/9.1.1. This affects the function kvstoreGetHashtable of the file src/kvstore.c. This manipulation of the argument didx causes out-of-bounds read. It is possible to initiate the attack remotely. Th…

  valkey-io valkey valkey valkey Debian Ubuntu
  Sep 6, 2026
• Low 2.4
  CVE-2026-82677

  valkey-io valkey Module Timer module.c moduleTimerHandler double free

  A vulnerability was determined in valkey-io valkey 9.1.0. Impacted is the function moduleTimerHandler of the file src/module.c of the component Module Timer Subsystem. This manipulation causes double free. The attack can be initiated remotely. The exploit has…

  valkey-io valkey redis valkey Debian Ubuntu
  Aug 31, 2026
• Low 2.2
  CVE-2026-82631

  valkey-io valkey Blocked-on-keys blocked.c handleClientsBlockedOnKey use after free

  A security flaw has been discovered in valkey-io valkey 9.1.0. The affected element is the function handleClientsBlockedOnKey of the file src/blocked.c of the component Blocked-on-keys Subsystem. The manipulation results in use after free. The attack may be p…

  valkey-io valkey redis valkey Debian Ubuntu Azure Linux
  Aug 31, 2026

References

• report
  https://access.redhat.com/security/cve/CVE-2026-85522
• article
  https://access.redhat.com/security/updates/classification/
• report
  https://access.redhat.com/security/cve/CVE-2026-86227
• report
  https://access.redhat.com/security/cve/CVE-2026-56684
• report
  https://access.redhat.com/security/cve/CVE-2026-63639
• report
  https://access.redhat.com/security/cve/CVE-2026-82677
• article
  https://images.redhat.com/
• report
  https://access.redhat.com/security/cve/CVE-2026-82631
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_61884.json
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2517907
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-56684
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-56684
• article
  https://github.com/valkey-io/valkey/commit/7cd5bcb7575d750ec2de618db80da58680a10fe3
• article
  https://github.com/valkey-io/valkey/pull/4234
• article
  https://github.com/valkey-io/valkey/releases/tag/7.2.14
• article
  https://github.com/valkey-io/valkey/releases/tag/8.0.10
• article
  https://github.com/valkey-io/valkey/releases/tag/8.1.9
• article
  https://github.com/valkey-io/valkey/releases/tag/9.0.5
• article
  https://github.com/valkey-io/valkey/releases/tag/9.1.1
• article
  https://github.com/valkey-io/valkey/security/advisories/GHSA-53mc-f3m3-99vh
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2517906
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-63639
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-63639
• article
  https://github.com/valkey-io/valkey/commit/06bc7768fe609f2054e69ccedefe7628f5675da9
• article
  https://github.com/valkey-io/valkey/commit/509cb3c74e8cbc9c0498ebe8b6c93dcd605e7271
• article
  https://github.com/valkey-io/valkey/commit/98465eaffe3f95524a5046318bfbc4bdb9798291
• article
  https://github.com/valkey-io/valkey/commit/e95911d4d65be8789fa3705f44d7ed1e65378445
• article
  https://github.com/valkey-io/valkey/commit/f8d2027e8d4df790ac04974bf606408c8ea62778
• article
  https://github.com/valkey-io/valkey/pull/4073
• article
  https://github.com/valkey-io/valkey/security/advisories/GHSA-mvcj-73cw-22m4
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2526157
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-82631
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-82631
• article
  https://github.com/user-attachments/files/30111628/PoC.zip
• article
  https://github.com/valkey-io/valkey/
• article
  https://github.com/valkey-io/valkey/commit/b2fb0e13f5b4c8c2fb63dcfc2c37a067a0d6d20b
• article
  https://github.com/valkey-io/valkey/issues/4198
• article
  https://github.com/valkey-io/valkey/pull/4212
• article
  https://vuldb.com/cve/CVE-2026-82631