Description
Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious actor with access to the Valkey clusterbus port can send an invalid packet that may cause an out bound read, which might result in the system crashing. The Valkey clusterbus packet processing code does not validate that a clusterbus ping extension packet is located within buffer of the clusterbus packet before attempting to read it. Versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12 fix the issue. As an additional mitigation, don't expose the cluster bus connection directly to end users, and protect the connection with its own network ACLs.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| valkey-io | valkey | < 7.2.12, >= 8.0.0, < 8.0.7, >= 8.1.0, < 8.1.6, >= 9.0.0, < 9.0.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | redis | 5:8.0.6-1 | — |
| Debian 14 | valkey | 8.1.4+dfsg1-2 | — |
| Debian 13 | redis | 5:8.0.2-3+deb13u2 | — |
| Debian 13 | valkey | 8.1.1+dfsg1-3+deb13u2 | — |
| Debian 12 | redis | 5:7.0.15-1~deb12u7 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 25.10 | valkey | 8.1.6+dfsg1-0ubuntu0.1 | — |
| Ubuntu 24.04 LTS | valkey | 7.2.12+dfsg1-0ubuntu0.1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | valkey +1 | 8.0.7-1.el10_1 | RHSA-2026:3443 |
| RHEL 9 | valkey +1 | 8.0.7-1.el9_7 | RHSA-2026:3507 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | valkey +1 | 8.0.7-1.el10_0 | RHSA-2026:5445 |
| Red Hat Hardened Images 1 | valkey +5 | 9.0.3-1.2.hum1 | RHSA-2026:8753 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | valkey +1 | 8.0.7-1.el10_1 | ALSA-2026:3443 |
| AlmaLinux 9 | valkey +1 | 8.0.7-1.el9_7 | ALSA-2026:3507 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | valkey | 8.0.7-1.el10_1 | RLSA-2026:3443 |
| Rocky Linux 9 | valkey | 8.0.7-1.el9_7 | RLSA-2026:3507 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | valkey | 8.0.7-150700.3.14.1 | SUSE-SU-2026:0848-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | valkey | 9.0.3-1.1 | openSUSE-SU-2026:10266-1 |
| openSUSE Leap 15.6 | valkey | 8.0.7-150600.13.20.1 | SUSE-SU-2026:0685-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | valkey | 9.0.3-r0 | — |
| Alpine v3.23 | valkey | 9.0.3-r0 | — |
| Alpine v3.22 | valkey | 8.1.6-r0 | — |
| Alpine v3.21 | valkey | 7.2.12-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | valkey +1 | 8.0.6-3.amzn2023.0.3 | ALAS2023-2026-1471 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | valkey | 8.0.7-1 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | valkey +1 | 8.0.7-1.el10_1 | ELSA-2026-3443 |
| Oracle Linux 9 | valkey +1 | 8.0.7-1.el9_7 | ELSA-2026-3507 |
Advisories 15
- ALSA-2026:3443 Important: valkey security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:3507 Important: valkey security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2026:8753 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 6, 2026
- RHSA-2026:5445 Red Hat Security Advisory: valkey security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2026:3507 Red Hat Security Advisory: valkey security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2026:3443 Red Hat Security Advisory: valkey security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- WID-SEC-2026-0546 Red Hat Enterprise Linux (Valkey): Mehrere Schwachstellen BSI CERT-Bund (WID) · May 27, 2026
- openSUSE-SU-2026:10266-1 valkey-9.0.3-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2026:0685-1 Security update for valkey SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2026:0848-1 Security update for valkey SUSE / openSUSE Security Updates · Mar 10, 2026
- RLSA-2026:3507 Important: valkey security update Rocky Linux Security Advisories · Mar 9, 2026
- ALAS2023-2026-1471 Important: valkey security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Mar 5, 2026
- ELSA-2026-3507 Important: valkey security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Mar 2, 2026
- RLSA-2026:3443 Important: valkey security update Rocky Linux Security Advisories · Feb 28, 2026
- ELSA-2026-3443 Important: valkey security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Feb 26, 2026