Summary
It was discovered that Valkey incorrectly handled errors for lua scripts.
An attacker could possibly use this issue to inject arbitrary information
into the response stream for other clients. (CVE-2025-67733)
It was discovered that Valkey incorrectly handled malformed cluster bus
messages. A remote attacker could possibly use this issue to cause Valkey
to crash, resulting in a denial of service. (CVE-2026-21863)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 24.04 LTS 24.04:LTS | valkey | 7.2.12+dfsg1-0ubuntu0.1 |
| Ubuntu · 25.10 | valkey | 8.1.6+dfsg1-0ubuntu0.1 |