Critical Security Update for Valkey: Addressing Data Tampering and Denial of Service Vulnerabilities
Summary
ALSA-2026:3443: Important: valkey security update. Affects valkey versions < 8.0.7-1.el10_1. Fixed in 8.0.7-1.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Valkey is an advanced key-value store often referred to as a data structure server. It supports various data types such as strings, hashes, lists, sets, and sorted sets, allowing atomic operations like appending to strings or incrementing hash values. Valkey operates primarily in-memory for performance, with options for data persistence through periodic dumps or command logging. It also features master-slave replication, transactions, Pub/Sub, Lua scripting, and time-limited keys, making it versatile for various programming languages. However, recent vulnerabilities have raised concerns regarding its security.
Vulnerability Detail
The vulnerabilities identified in Valkey include improper null character handling in Lua scripts (CVE-2025-67733) leading to potential data tampering, and a denial of service (CVE-2026-21863) caused by invalid clusterbus packets. These issues can compromise the integrity of data and disrupt service availability, posing significant risks to applications relying on Valkey for data management.
How To Fix
Minimum fixed version
8.0.7-1.el10_1
This is the first release that contains the fix.
sudo dnf update valkeyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can restrict the execution of Lua scripts or disable clusterbus features until the update is applied. This can help mitigate the risk of exploitation while you prepare for the patch.
Conclusion
The identified vulnerabilities in Valkey pose serious risks to data integrity and service availability. It is crucial to apply the recommended updates promptly to safeguard your applications. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for valkey →
FAQ
Valkey is a key-value store that allows for efficient data management and supports various data types and operations.
The main vulnerabilities include data tampering through improper null character handling in Lua scripts and denial of service via invalid clusterbus packets.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by these vulnerabilities without needing to sign up.
If immediate updates are not possible, consider restricting Lua script execution and disabling clusterbus features as a temporary workaround.
For more details, refer to the CVE pages linked in the advisory or consult the AlmaLinux advisory database.
Related vulnerabilities
Recent vulnerabilities recorded for valkey.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
