Valkey is a high-performance key-value store supporting complex data types and atomic operations, often used in Red Hat Enterprise Linux 9. Two vulnerabilities have been fixed: CVE-2025-67733, which allows data tampering and denial of service via improper null character handling in Lua scripts, and CVE-2026-21863, which enables denial of service through invalid clusterbus packets. These issues could impact the integrity and availability of Valkey services. Red Hat has issued an important security advisory (RHSA-2026:3507) providing updated Valkey packages that remediate these vulnerabilities across supported platforms.

The vulnerabilities can lead to data tampering and denial of service conditions in Valkey, potentially affecting applications relying on it for data storage and caching. Improper null character handling in Lua scripts may allow malicious manipulation of data or service disruption. Invalid clusterbus packets can cause denial of service, impacting availability. No evidence of active exploitation is currently known. The overall security impact is rated as important by Red Hat.

Red Hat has released updated Valkey packages (version 8.0.7-1.el9_7) that address these vulnerabilities. Users should apply the security update promptly following Red Hat's guidance at https://access.redhat.com/articles/11258. This update is available for all affected Red Hat Enterprise Linux 9 variants and architectures. No additional mitigation steps are indicated by the vendor advisory.