Critical Security Flaw in Valkey Package: Remote Code Execution Vulnerability
Summary
ALSA-2026:25216: Important: valkey security update. Affects valkey versions < 8.0.9-1.el10_2. Fixed in 8.0.9-1.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Valkey is an advanced key-value store often referred to as a data structure server. It supports various data types such as strings, hashes, lists, sets, and sorted sets, allowing atomic operations for enhanced performance. Valkey operates primarily in-memory, with options for data persistence through periodic dumps or command logging. It also features master-slave replication, transactions, Pub/Sub, Lua scripting, and time-limited keys, making it versatile for various programming languages. However, recent vulnerabilities have raised concerns regarding its security.
Vulnerability Detail
The vulnerability stems from a use-after-free issue in the unblock client flow, which can lead to remote code execution. Additionally, there are risks associated with Lua scripting and invalid memory access during the RESTORE operation, both of which can also allow remote code execution. These vulnerabilities can be exploited by attackers to execute arbitrary code on the server, potentially compromising sensitive data and system integrity.
How To Fix
Minimum fixed version
8.0.9-1.el10_2
This is the first release that contains the fix.
sudo dnf update valkeyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider disabling Lua scripting and avoiding the use of the RESTORE command until the package is updated. This can help mitigate the risk of exploitation while waiting for the official patch.
Conclusion
The Valkey package has a critical vulnerability that could allow remote code execution. It is crucial to update to the latest patched version to protect your system. Temporary workarounds can help mitigate risks until the update is applied.
See every vulnerability recorded for valkey →
FAQ
The vulnerability is a use-after-free issue that can lead to remote code execution, allowing attackers to execute arbitrary code on the server.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Exploitation of this vulnerability could lead to unauthorized access, data breaches, and complete system compromise.
Yes, a patch is available in version 8.0.9-1.el10_2 of the Valkey package.
If immediate updates are not possible, consider disabling Lua scripting and avoiding the RESTORE command as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for valkey.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
