Most recent entries from all

ALSA-2026:3443 — Important: valkey security update

Affected: AlmaLinux:10: valkey, AlmaLinux:10: valkey-devel

Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set. In order to achieve its outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log. Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth. Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave like a cache. You can use Valkey from most programming languages also.

Security Fix(es):

* Valkey: Valkey: Data tampering and denial of service via improper null character handling in Lua scripts (CVE-2025-67733) * valkey: Valkey: Denial of Service via invalid clusterbus packet (CVE-2026-21863)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2026-07339

BELL-CVE-2026-21863

Affected: Alpaquita:23: redis, Alpaquita:25: redis, Alpaquita:stream: redis

BIT-valkey-2026-21863 — Malformed Valkey Cluster bus message can lead to Remote DoS

Affected: Bitnami: valkey

Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious actor with access to the Valkey clusterbus port can send an invalid packet that may cause an out bound read, which might result in the system crashing. The Valkey clusterbus packet processing code does not validate that a clusterbus ping extension packet is located within buffer of the clusterbus packet before attempting to read it. Versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12 fix the issue. As an additional mitigation, don't expose the cluster bus connection directly to end users, and protect the connection with its own network ACLs.

certfr-2026-avi-0223 — De multiples vulnérabilités ont été découvertes dans les produits Microsoft. Certaines d'entre elles permettent à un at…

certfr-2026-avi-0223

EUVD-2026-337500

fkie_cve-2026-21863

msrc_CVE-2026-21863 — Malformed Valkey Cluster bus message can lead to Remote DoS

msrc_CVE-2026-21863

openSUSE-SU-2026:10266-1 — valkey-9.0.3-1.1 on GA media

valkey-9.0.3-1.1 on GA media

RHSA-2026:5445 — Red Hat Security Advisory: valkey security update

Valkey: Valkey: Data tampering and denial of service via improper null character handling in Lua scripts valkey: Valkey: Denial of Service via invalid clusterbus packet

SUSE-SU-2026:0685-1 — Security update for valkey

Security update for valkey

UBUNTU-CVE-2026-21863

Affected: Ubuntu:24.04:LTS: valkey, Ubuntu:25.10: valkey

WID-SEC-W-2026-0546 — Red Hat Enterprise Linux (Valkey): Mehrere Schwachstellen

Ein entfernter, authentisierter oder anonymer Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux bezüglich Valkey ausnutzen, um Dateien zu manipulieren oder einen Denial-of-Service-Zustand zu verursachen.