Critical Security Update for Valkey: Addressing Multiple Vulnerabilities
Summary
ALSA-2025:19675: Important: valkey security update. Affects valkey versions < 8.0.6-1.el10_0. Fixed in 8.0.6-1.el10_0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Valkey is an advanced key-value store often utilized as a data structure server, capable of handling various data types such as strings, hashes, lists, sets, and sorted sets. It allows for atomic operations, high-performance in-memory data handling, and supports persistence through disk dumping or command logging. Valkey also features master-slave replication, transactions, Pub/Sub, Lua scripting, and time-limited keys, making it versatile for various programming languages. However, recent vulnerabilities have been identified that could compromise its security.
Vulnerability Detail
The vulnerabilities in Valkey stem from issues within its Lua library commands, leading to potential integer overflow and remote code execution (CVE-2025-46817). Additionally, authenticated users can execute Lua scripts as different users (CVE-2025-46818), and specially crafted Lua scripts can cause denial of service (CVE-2025-46819). A use-after-free vulnerability in the Lua implementation may also allow for remote code execution (CVE-2025-49844). These vulnerabilities could lead to unauthorized access, service disruption, and execution of malicious code.
How To Fix
Minimum fixed version
8.0.6-1.el10_0
This is the first release that contains the fix.
sudo dnf update valkeyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, restrict access to the Lua scripting functionalities and limit user permissions until the packages can be updated. This can be done by modifying the configuration settings to disable Lua script execution for untrusted users.
Conclusion
The identified vulnerabilities in Valkey pose significant security risks that could lead to unauthorized access and service disruptions. It is crucial to update to the latest patched version to mitigate these risks. Implementing temporary workarounds can provide additional protection until the update is applied.
See every vulnerability recorded for valkey →
FAQ
The vulnerabilities can lead to unauthorized code execution, denial of service, and potential data breaches.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file. Visit Vulert Scanner to check your application without needing to sign up.
Implement workarounds such as restricting Lua script execution and limiting user permissions until you can apply the update.
While specific exploits may not be publicly disclosed, the nature of the vulnerabilities suggests that they could be exploited by malicious actors to gain unauthorized access or disrupt services.
Detailed information can be found on the CVE pages linked in the advisory, which provide insights into the vulnerabilities' impacts and technical details.
Related vulnerabilities
Recent vulnerabilities recorded for valkey.
