Critical Security Flaw in Valkey Package: Remote Code Execution Vulnerabilities
Summary
ALSA-2026:25925: Important: valkey security update. Affects valkey versions < 8.0.9-1.el9_8. Fixed in 8.0.9-1.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Valkey is an advanced key-value store often referred to as a data structure server. It supports various data types such as strings, hashes, lists, sets, and sorted sets, allowing atomic operations like appending to strings and computing set intersections. Valkey operates primarily in-memory for high performance, with options for data persistence through periodic dumps or command logging. It also features master-slave replication, transactions, Pub/Sub, Lua scripting, and time-limited keys, making it versatile for various programming languages. However, recent vulnerabilities expose it to significant security risks.
Vulnerability Detail
The Valkey package has been identified with multiple critical vulnerabilities that may allow remote code execution. These include a use-after-free issue in the unblock client flow (CVE-2026-23479), a similar vulnerability in Lua scripting (CVE-2026-23631), and an invalid memory access during the RESTORE command (CVE-2026-25243). These vulnerabilities arise from improper memory management, potentially allowing attackers to execute arbitrary code on the server, leading to severe security breaches.
How To Fix
Minimum fixed version
8.0.9-1.el9_8
This is the first release that contains the fix.
sudo dnf update valkeyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling Lua scripting and any features that rely on the unblock client flow until the package can be updated. This can help reduce the attack surface while waiting for a permanent fix.
Conclusion
The Valkey package has critical vulnerabilities that pose significant security risks, including remote code execution. It is essential to update to the latest patched version to protect your systems. Utilize tools like Vulert for ongoing monitoring of vulnerabilities in your software.
See every vulnerability recorded for valkey →
FAQ
The vulnerabilities involve use-after-free errors and invalid memory access, which can lead to remote code execution.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
If immediate updates are not possible, consider disabling vulnerable features as a temporary workaround.
While specific exploits may not be publicly disclosed, the nature of the vulnerabilities suggests that they could be exploited by attackers to execute arbitrary code.
Regular updates are crucial for maintaining security, as they often include patches for known vulnerabilities that could be exploited by attackers.
Related vulnerabilities
Recent vulnerabilities recorded for valkey.
