Critical Security Update for Valkey: Addressing Data Tampering and Denial of Service Vulnerabilities
Summary
ALSA-2026:3507: Important: valkey security update. Affects valkey versions < 8.0.7-1.el9_7. Fixed in 8.0.7-1.el9_7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Valkey is an advanced key-value store known for its high performance and versatility in handling various data types such as strings, hashes, lists, sets, and sorted sets. It supports atomic operations, master-slave replication, and offers features like transactions, Pub/Sub, and Lua scripting. However, recent vulnerabilities have been identified that could compromise its integrity and availability.
Vulnerability Detail
The vulnerabilities in Valkey stem from improper handling of null characters in Lua scripts, leading to potential data tampering (CVE-2025-67733), and a denial of service caused by invalid clusterbus packets (CVE-2026-21863). These issues can allow attackers to manipulate data or disrupt service, posing significant risks to applications relying on Valkey for data storage and management.
How To Fix
Minimum fixed version
8.0.7-1.el9_7
This is the first release that contains the fix.
sudo dnf update valkeyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can restrict the execution of Lua scripts or disable clusterbus functionality until the update is applied. This can help mitigate the risk of exploitation while you prepare for the patch.
Conclusion
The identified vulnerabilities in Valkey pose significant risks that can compromise data integrity and service availability. It is crucial to apply the available patch promptly and consider temporary workarounds to mitigate risks until the update can be implemented.
See every vulnerability recorded for valkey →
FAQ
The main vulnerabilities include data tampering via improper null character handling in Lua scripts and denial of service through invalid clusterbus packets.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any installation.
These vulnerabilities can lead to unauthorized data manipulation and service disruptions, which can severely affect applications relying on Valkey.
Yes, a patch is available. Update to Valkey version 8.0.7-1.el9_7 to fix the vulnerabilities.
If you cannot apply the patch immediately, consider restricting Lua script execution and disabling clusterbus functionality as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for valkey.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
