p PatchFirst

PatchFirst · Vulnérabilités récentes

Vulnérabilités de valkey

Vulnérabilités publiées pour valkey au cours des 30 derniers jours : 0. Présentes dans le catalogue KEV : 0.

RSS ↗
Filtrer les vulnérabilités
Effacer les filtres

Vulnérabilités : 25

  1. CVE-2026-86227

    Faible · CVSS 2.3EPSS 0,52%Correctif disponible

    valkey-io valkey kvstore.c kvstoreGetHashtable out-of-bounds

    A weakness has been identified in valkey-io valkey up to 9.0.5/9.1.1. This affects the function kvstoreGetHashtable of the file src/kvstore.c. This manipulation of the argument didx causes out-of-bounds read. It is possible to initiate the attack remotely. The attack is considered to have high complexity. It is indicated that the exploitability is difficult. The exploit has been made available to the public and could be used for attacks. Patch name: 4691888e7fab3df128f0bde5750c9fde2ae552fa. To fix this issue, it is recommended to deploy a patch. Exploitation requires cluster mode plus attacker-controlled dump.rdb at startup (data-dir write ac

    valkeySystèmes d’exploitation Bases de données
    • Mettez à jour vers 9.1.2-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  2. CVE-2026-85522

    Moyenne · CVSS 6.9EPSS 0,86%Correctif disponible

    valkey-io valkey Slot Migration cluster_migrateslots.c createSlotImportJob out-of-bounds

    A vulnerability was detected in valkey-io valkey up to 9.5.4/9.1.0. Affected by this vulnerability is the function createSlotImportJob of the file src/cluster_migrateslots.c of the component Slot Migration. The manipulation of the argument job_name results in out-of-bounds read. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version 9.0.5 and 9.1.1 addresses this issue. The patch is identified as f4dc3ca09eb650c2fe14060090a41c524eca803f. Upgrading the affected component is advised.

    valkeySystèmes d’exploitation Bases de données
    • Mettez à jour vers 9.1.2-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  3. CVE-2026-82677

    Moyenne · CVSS 4.8EPSS 0,52%Correctif disponible

    valkey-io valkey Module Timer module.c moduleTimerHandler double free

    A vulnerability was determined in valkey-io valkey 9.1.0. Impacted is the function moduleTimerHandler of the file src/module.c of the component Module Timer Subsystem. This manipulation causes double free. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Patch name: b349fe2821e3998534b1454c1b64a478daf8c6b7. To fix this issue, it is recommended to deploy a patch.

    valkeySystèmes d’exploitation Bases de données
    • Mettez à jour vers 9.1.2-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  4. CVE-2026-82631

    Faible · CVSS 2.1EPSS 0,55%Correctif disponible

    valkey-io valkey Blocked-on-keys blocked.c handleClientsBlockedOnKey use after free

    A security flaw has been discovered in valkey-io valkey 9.1.0. The affected element is the function handleClientsBlockedOnKey of the file src/blocked.c of the component Blocked-on-keys Subsystem. The manipulation results in use after free. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is described as difficult. The exploit has been released to the public and may be used for attacks. The patch is identified as b2fb0e13f5b4c8c2fb63dcfc2c37a067a0d6d20b. Applying a patch is advised to resolve this issue.

    valkeySystèmes d’exploitation Bases de données
    • Mettez à jour vers 9.1.2-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  5. CVE-2026-63639

    Élevée · CVSS 8.8EPSS 1,17%Correctif disponible

    Valkey: UAF in stream deserialization may lead to remote code execution

    Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when one consumer is deleted while another still references the shared NACK and potentially allowing remote code execution. This issue is fixed in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1.

    valkeySystèmes d’exploitation Bases de données
    • Mettez à jour vers 9.1.1-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  6. CVE-2026-56684

    Élevée · CVSS 7.5EPSS 0,89%Correctif disponible

    Valkey: TLS pending-data processing use-after-free may allow remote code execution

    Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's tlsProcessPendingData function iterates pending_list while an authenticated client can trigger CLIENT KILL, causing connTLSClose to delete the iterator's cached next node and producing a use-after-free that can crash the server or potentially allow remote code execution when TLS is enabled. This issue is fixed in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1.

    valkeySystèmes d’exploitation Bases de données
    • Mettez à jour vers 9.1.1-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  7. CVE-2026-25243

    Élevée · CVSS 7.7EPSS 3,66%Correctif disponible

    redis-server RESTORE invalid memory access may allow remote code execution

    Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This is patched in version 8.6.3.

    valkeySystèmes d’exploitation Bases de données
    • Mettez à jour vers 9.1.1-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  8. CVE-2026-23631

    Moyenne · CVSS 6.1EPSS 2,8%Correctif disponible

    redis-server Lua use-after-free may allow remote code execution

    Redis is an in-memory data structure store. In all versions of redis-server with Lua scripting, an authenticated attacker can exploit the master-replica synchronization mechanism to trigger a use-after-free on replicas where replica-read-only is disabled or can be disabled, which may lead to remote code execution. A workaround is to prevent users from executing Lua scripts or avoid using replicas where replica-read-only is disabled. This is patched in version 8.6.3.

    valkeySystèmes d’exploitation Bases de données
    • Mettez à jour vers 9.1.1-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  9. CVE-2026-23479

    Élevée · CVSS 7.7EPSS 1,51%Correctif disponible

    redis-server use-after-free in unblock client flow may allow remote code execution

    Redis is an in-memory data structure store. In redis-server from 7.2.0 until 8.6.3, the unblock client flow does not handle an error return from `processCommandAndResetClient` when re-executing a blocked command. If a blocked client is evicted during this flow, an authenticated attacker can trigger a use-after-free that may lead to remote code execution. This has been patched in version 8.6.3.

    valkeySystèmes d’exploitation Bases de données
    • Mettez à jour vers 9.1.1-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  10. CVE-2026-21863

    Élevée · CVSS 7.5EPSS 0,85%Correctif disponible

    Malformed Valkey Cluster bus message can lead to Remote DoS

    Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious actor with access to the Valkey clusterbus port can send an invalid packet that may cause an out bound read, which might result in the system crashing. The Valkey clusterbus packet processing code does not validate that a clusterbus ping extension packet is located within buffer of the clusterbus packet before attempting to read it. Versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12 fix the issue. As an additional mitigation, don't expose the cluster bus connection directly to end users, and protect the connection with its own network ACLs.

    valkeySystèmes d’exploitation Bases de données
    • Mettez à jour vers 8.1.4+dfsg1-2
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  11. CVE-2025-67733

    Élevée · CVSS 8.5EPSS 0,65%Correctif disponible

    Valkey Affected by RESP Protocol Injection via Lua error_reply

    Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious user can use scripting commands to inject arbitrary information into the response stream for the given client, potentially corrupting or returning tampered data to other users on the same connection. The error handling code for lua scripts does not properly handle null characters. Versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12 fix the issue.

    valkeySystèmes d’exploitation Bases de données
    • Mettez à jour vers 8.1.4+dfsg1-2
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  12. CVE-2025-49844

    Critique · CVSS 10EPSS 82,64%Code d’exploitation publicCorrectif disponible

    Redis Lua Use-After-Free may lead to remote code execution

    Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.

    valkeySystèmes d’exploitation Bases de données
    • Mettez à jour vers 8.1.4+dfsg1-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  13. CVE-2025-46819

    Moyenne · CVSS 6.3EPSS 1,09%Code d’exploitation publicCorrectif disponible

    Redis is vulnerable to DoS via specially crafted LUA scripts

    Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted LUA script to read out-of-bound data or crash the server and subsequent denial of service. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to block a script by restricting both the EVAL and FUNCTION command families.

    valkeySystèmes d’exploitation Bases de données
    • Mettez à jour vers 8.1.4+dfsg1-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  14. CVE-2025-46818

    Moyenne · CVSS 6EPSS 0,74%Code d’exploitation publicCorrectif disponible

    Redis: Authenticated users can execute LUA scripts as a different user

    Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate different LUA objects and potentially run their own code in the context of another user. The problem exists in all versions of Redis with LUA scripting. This issue is fixed in version 8.2.2. A workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing LUA scripts. This can be done using ACL to block a script by restricting both the EVAL and FUNCTION command families.

    valkeySystèmes d’exploitation Bases de données
    • Mettez à jour vers 8.1.4+dfsg1-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  15. CVE-2025-46817

    Élevée · CVSS 7EPSS 3,92%Code d’exploitation publicCorrectif disponible

    Lua library commands may lead to integer overflow and potential RCE

    Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to cause an integer overflow and potentially lead to remote code execution The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2.

    valkeySystèmes d’exploitation Bases de données
    • Mettez à jour vers 8.1.4+dfsg1-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  16. CVE-2025-48367

    Élevée · CVSS 7.5EPSS 1,19%Correctif disponible

    Redis DoS Vulnerability due to bad connection error handling

    Redis is an open source, in-memory database that persists on disk. An unauthenticated connection can cause repeated IP protocol errors, leading to client starvation and, ultimately, a denial of service. This vulnerability is fixed in 8.0.3, 7.4.5, 7.2.10, and 6.2.19.

    valkeySystèmes d’exploitation Bases de données
    • Mettez à jour vers 8.1.1+dfsg1-3
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  17. CVE-2025-32023

    Élevée · CVSS 7EPSS 6,47%Code d’exploitation publicCorrectif disponible

    Redis allows out of bounds writes in hyperloglog commands leading to RCE

    Redis is an open source, in-memory database that persists on disk. From 2.8 to before 8.0.3, 7.4.5, 7.2.10, and 6.2.19, an authenticated user may use a specially crafted string to trigger a stack/heap out of bounds write on hyperloglog operations, potentially leading to remote code execution. The bug likely affects all Redis versions with hyperloglog operations implemented. This vulnerability is fixed in 8.0.3, 7.4.5, 7.2.10, and 6.2.19. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing hyperloglog operations. This can be done using ACL to restrict HLL commands.

    valkeySystèmes d’exploitation Bases de données
    • Mettez à jour vers 8.1.1+dfsg1-3
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  19. CVE-2025-27151

    Moyenne · CVSS 4.7EPSS 0,98%Correctif disponible

    redis-check-aof may lead to stack overflow and potential RCE

    Redis is an open source, in-memory database that persists on disk. In versions starting from 7.0.0 to before 8.0.2, a stack-based buffer overflow exists in redis-check-aof due to the use of memcpy with strlen(filepath) when copying a user-supplied file path into a fixed-size stack buffer. This allows an attacker to overflow the stack and potentially achieve code execution. This issue has been patched in version 8.0.2.

    valkeySystèmes d’exploitation Bases de données
    • Mettez à jour vers 8.1.1+dfsg1-1.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  20. CVE-2025-21605

    Élevée · CVSS 7.5EPSS 0,86%Correctif disponible

    Redis DoS Vulnerability due to unlimited growth of output buffers abused by unauthenticated client

    Redis is an open source, in-memory database that persists on disk. In versions starting at 2.6 and prior to 7.4.3, An unauthenticated client can cause unlimited growth of output buffers, until the server runs out of memory or is killed. By default, the Redis configuration does not limit the output buffer of normal clients (see client-output-buffer-limit). Therefore, the output buffer can grow unlimitedly over time. As a result, the service is exhausted and the memory is unavailable. When password authentication is enabled on the Redis server, but no password is provided, the client can still cause the output buffer to grow from "NOAUTH" respo

    valkeySystèmes d’exploitation Bases de données
    • Mettez à jour vers 8.1.1+dfsg1-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

Vérifiez votre serveur

Comparez votre pile et les versions installées aux bases de vulnérabilités actuelles.

Vérifiez votre serveur →