Critical Remote Code Execution Vulnerability in Valkey Package
Summary
RLSA-2026:64796: Important: valkey security, bug fix, and enhancement update. Affects valkey versions < 0:8.0.11-1.el10_2. Fixed in 0:8.0.11-1.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Valkey is an advanced key-value store that functions as a data structure server, allowing users to manage various data types such as strings, hashes, lists, sets, and sorted sets. It supports atomic operations and can persist data through periodic dumps or command logging. Valkey is designed for high performance with features like master-slave replication, transactions, Pub/Sub, Lua scripting, and configurable caching behavior. However, recent vulnerabilities have been identified that could allow remote code execution, posing significant security risks.
Vulnerability Detail
The vulnerability arises from a use-after-free condition during stream deserialization and TLS pending-data processing, which can be exploited to execute arbitrary code remotely. Specifically, a specially crafted RESTORE payload can trigger this vulnerability in Redis, while Valkey's handling of data streams and TLS connections can lead to similar exploitation. The potential ramifications include unauthorized access to sensitive data, system compromise, and disruption of service, making it critical for users to address this issue promptly.
How To Fix
Minimum fixed version
0:8.0.11-1.el10_2
This is the first release that contains the fix.
sudo dnf update valkeyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users may consider disabling remote access to Valkey or implementing strict firewall rules to limit exposure until the package can be updated. Additionally, monitoring logs for unusual activity can help mitigate risks.
Conclusion
The identified vulnerabilities in the Valkey package pose significant risks, including remote code execution. It is crucial for users to update to the latest patched version to safeguard their systems. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for valkey →
FAQ
The CVSS score of the vulnerability is 8.8, indicating a critical level of severity.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading a manifest file like package-lock.json, you can receive real-time alerts. You can also check your application using the Vulert playground without signing up.
The vulnerability can lead to remote code execution, allowing attackers to gain unauthorized access, manipulate data, or disrupt services.
Yes, the patched version of Valkey is 0:8.0.11-1.el10_2. Users should update to this version to mitigate the risk.
If immediate updates are not possible, consider implementing strict access controls, disabling remote access, and monitoring for unusual activity as temporary measures.
References
Related vulnerabilities
Recent vulnerabilities recorded for valkey.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
