Denial of Service Vulnerability in Valkey Package Due to Redis Connection Issues
Summary
CVE-2025-48367: Redis is an open source, in-memory database that persists on disk. Affects valkey across 6 version ranges.
< 5a752e19782b9f8f80c7ef85e21cb47647954f09
< 7e0f53393290f7c1f35596117b67748efad16580
< 8.1.1-r2
< b49d5c0cf4e96a277d4b4e98f61d10c792b37003
< bde62951accfc4bb0a516276fd0b4b307e140ce2
< fa00bd2fff1533ad6e8483d9ce8868f383df2fbb
Fixed in 8.1.1-r2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Valkey is an open-source package designed for use within the Alpine Linux ecosystem, providing essential functionalities for managing key-value data efficiently. Redis, the underlying database technology utilized by Valkey, is an in-memory database that persists data on disk. This package is widely used for its speed and flexibility in handling data, but it is susceptible to vulnerabilities that can lead to service disruptions.
Vulnerability Detail
The vulnerability identified as CVE-2025-48367 arises from an unauthenticated connection to Redis, which can trigger repeated IP protocol errors. This situation can lead to client starvation, ultimately resulting in a denial of service. The issue is particularly critical as it can affect the availability of services relying on Valkey, making it imperative for users to address this vulnerability promptly.
How To Fix
Minimum fixed version
8.1.1-r2
This is the first release that contains the fix.
sudo apk add --upgrade valkeyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the number of unauthenticated connections to Redis by configuring the Redis server settings to require authentication. This can be done by modifying the Redis configuration file (usually located at /etc/redis/redis.conf) and setting the 'requirepass' directive to a strong password.
Conclusion
In summary, CVE-2025-48367 poses a significant risk to applications using the Valkey package due to its reliance on Redis. Users are strongly encouraged to update to the patched version 8.1.1-r2 to ensure the security and availability of their services. Implementing workarounds can provide temporary relief until updates are applied.
See every vulnerability recorded for valkey →
FAQ
CVE-2025-48367 is a vulnerability in the Redis database that can lead to denial of service due to unauthenticated connections causing repeated IP protocol errors.
The vulnerability can lead to client starvation and service disruptions for applications using Valkey, as it relies on Redis for data management.
The vulnerability affects all versions of Valkey prior to the patched version 8.1.1-r2.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, consider implementing the workaround by requiring authentication for Redis connections to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for valkey.
