Denial of Service Vulnerability in Valkey Package - CVE-2025-48367
Summary
ALPINE-CVE-2025-48367: Redis is an open source, in-memory database that persists on disk. Affects valkey versions < 8.1.1-r2. Fixed in 8.1.1-r2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Valkey is a package within the Alpine ecosystem, designed to provide key functionalities for applications requiring secure key management. It is widely used due to its lightweight nature and ease of integration. However, like many software packages, it is susceptible to vulnerabilities that can compromise its performance and security.
Vulnerability Detail
The vulnerability identified as CVE-2025-48367 allows for an unauthenticated connection to Redis, an in-memory database utilized by Valkey. This connection can trigger repeated IP protocol errors, which may lead to client starvation and ultimately result in a denial of service. The issue arises from improper handling of connections, making it critical for users to address this vulnerability to maintain service availability.
How To Fix
Minimum fixed version
8.1.1-r2
This is the first release that contains the fix.
sudo apk add --upgrade valkeyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the Redis service by implementing firewall rules to block unauthenticated connections. This can be done using iptables or similar tools to ensure that only trusted IP addresses can connect to the Redis service.
Conclusion
The CVE-2025-48367 vulnerability in the Valkey package poses a significant risk of denial of service due to unauthenticated Redis connections. Users are strongly advised to update to the patched version 8.1.1-r2 to ensure the security and availability of their applications. Implementing temporary workarounds can help mitigate risks until an update can be performed.
See every vulnerability recorded for valkey →
FAQ
CVE-2025-48367 is a vulnerability in the Valkey package that allows unauthenticated connections to Redis, potentially leading to denial of service.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can lead to client starvation and denial of service, affecting the availability of your application.
Yes, the vulnerability is fixed in Valkey version 8.1.1-r2 and later. Users should update to this version to mitigate the risk.
If immediate updating is not possible, implement firewall rules to restrict access to the Redis service as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for valkey.
