Critical Security Update for Valkey: Addressing Multiple Vulnerabilities
Summary
ALSA-2025:21936: Important: valkey security update. Affects valkey versions < 8.0.6-2.el10_1. Fixed in 8.0.6-2.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Valkey is an advanced key-value store often referred to as a data structure server. It supports various data types such as strings, hashes, lists, sets, and sorted sets, allowing atomic operations like appending to strings or incrementing hash values. Valkey operates primarily in-memory for performance, with options for data persistence through periodic disk dumps or command logging. It features master-slave replication, transactions, Pub/Sub, Lua scripting, and time-limited keys, making it versatile for various programming languages.
Vulnerability Detail
The vulnerabilities in Valkey stem from issues in its Lua library commands, which can lead to integer overflow and potential remote code execution (CVE-2025-46817). Authenticated users may execute Lua scripts as different users (CVE-2025-46818), and specially crafted Lua scripts can cause denial of service (CVE-2025-46819). Additionally, a use-after-free vulnerability in Redis Lua can also lead to remote code execution (CVE-2025-49844). These vulnerabilities can compromise the integrity and availability of the Valkey service, posing significant risks to applications relying on it.
How To Fix
Minimum fixed version
8.0.6-2.el10_1
This is the first release that contains the fix.
sudo dnf update valkeyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, restrict access to the Valkey service by implementing strict authentication and authorization controls to prevent unauthorized users from executing Lua scripts.
Conclusion
The recent vulnerabilities discovered in Valkey pose significant risks to applications utilizing this key-value store. It is crucial to update to the latest patched version to mitigate these risks and ensure the security of your systems. Implementing access controls can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for valkey →
FAQ
Valkey is an advanced key-value store that allows for various data structures and atomic operations, making it suitable for high-performance applications.
The vulnerabilities include integer overflow, unauthorized Lua script execution, denial of service via crafted scripts, and a use-after-free issue that can lead to remote code execution.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
If immediate updates are not possible, implement strict access controls to limit who can execute Lua scripts on your Valkey instance.
For detailed information, refer to the CVE pages linked in the advisory or visit the official Valkey documentation.
Related vulnerabilities
Recent vulnerabilities recorded for valkey.
