Critical Security Update for Valkey: Addressing Multiple Vulnerabilities
Summary
ALSA-2025:21916: Important: valkey security update. Affects valkey versions < 8.0.6-2.el9_7. Fixed in 8.0.6-2.el9_7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Valkey is an advanced key-value store often referred to as a data structure server. It supports various data types including strings, hashes, lists, sets, and sorted sets, allowing for atomic operations like appending to strings and incrementing hash values. Valkey operates primarily in-memory for high performance, with options for data persistence through periodic dumps or command logging. It also features master-slave replication, transactions, Pub/Sub, Lua scripting, and time-limited keys, making it versatile for various programming languages.
Vulnerability Detail
The vulnerabilities in Valkey stem from issues within its Lua library commands, which can lead to integer overflow, remote code execution (RCE), and denial of service (DoS) attacks through specially crafted Lua scripts. Authenticated users may exploit these vulnerabilities to execute scripts as different users, and a use-after-free condition could further facilitate RCE. These vulnerabilities pose significant risks to data integrity and system security.
How To Fix
Minimum fixed version
8.0.6-2.el9_7
This is the first release that contains the fix.
sudo dnf update valkeyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict access to the Lua scripting features of Valkey until the update can be applied. This can be done by modifying the configuration settings to disable Lua script execution for untrusted users.
Conclusion
In summary, the recent vulnerabilities in Valkey pose significant risks that can be mitigated by updating to the latest patched version. Users are encouraged to apply the update promptly and consider using Vulert for ongoing monitoring of open-source vulnerabilities.
See every vulnerability recorded for valkey →
FAQ
The main vulnerabilities include integer overflow, unauthorized Lua script execution, denial of service via crafted scripts, and a use-after-free condition leading to remote code execution.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
These vulnerabilities can lead to unauthorized access, data corruption, service disruption, and potential remote code execution, compromising the security of your application.
Yes, you can temporarily restrict access to Lua scripting features to mitigate risks until the update is applied.
For more details, refer to the CVE pages associated with these vulnerabilities: CVE-2025-46817, CVE-2025-46818, CVE-2025-46819, and CVE-2025-49844.
Related vulnerabilities
Recent vulnerabilities recorded for valkey.
