Red Hat Security Advisory: valkey security update
Two security vulnerabilities have been identified in Valkey, an advanced key-value store used in Red Hat Enterprise Linux 10. The first vulnerability (CVE-2025-67733) involves data tampering and denial of service caused by improper null character handling in Lua scripts. The second vulnerability (CVE-2026-21863) allows denial of service via invalid clusterbus packets. Red Hat has issued a security update addressing these issues in Valkey version 8.0.7-1.el10_1 for multiple architectures. The update is rated as Important by Red Hat Product Security.
AI Analysis
Technical Summary
Valkey, a data structure server supporting various atomic operations and Lua scripting, contains two vulnerabilities: CVE-2025-67733, which permits data tampering and denial of service through improper handling of null characters in Lua scripts, and CVE-2026-21863, which allows denial of service via invalid clusterbus packets. These vulnerabilities affect Red Hat Enterprise Linux 10 distributions across multiple hardware architectures. Red Hat has released an update (valkey-8.0.7-1.el10_1) to address these issues. The advisory references Red Hat Security Advisory RHSA-2026:3443 for detailed remediation instructions.
Potential Impact
The vulnerabilities allow attackers to tamper with data and cause denial of service conditions in Valkey, potentially disrupting applications relying on this key-value store. The improper null character handling in Lua scripts can lead to data integrity issues and service interruptions. The invalid clusterbus packet vulnerability can cause denial of service, affecting availability. No known exploits in the wild have been reported at this time.
Mitigation Recommendations
Red Hat has released an updated valkey package version 8.0.7-1.el10_1 that addresses these vulnerabilities. Users of Red Hat Enterprise Linux 10 should apply this update promptly following Red Hat's official guidance at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official patch.
Red Hat Security Advisory: valkey security update
Description
Two security vulnerabilities have been identified in Valkey, an advanced key-value store used in Red Hat Enterprise Linux 10. The first vulnerability (CVE-2025-67733) involves data tampering and denial of service caused by improper null character handling in Lua scripts. The second vulnerability (CVE-2026-21863) allows denial of service via invalid clusterbus packets. Red Hat has issued a security update addressing these issues in Valkey version 8.0.7-1.el10_1 for multiple architectures. The update is rated as Important by Red Hat Product Security.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Valkey, a data structure server supporting various atomic operations and Lua scripting, contains two vulnerabilities: CVE-2025-67733, which permits data tampering and denial of service through improper handling of null characters in Lua scripts, and CVE-2026-21863, which allows denial of service via invalid clusterbus packets. These vulnerabilities affect Red Hat Enterprise Linux 10 distributions across multiple hardware architectures. Red Hat has released an update (valkey-8.0.7-1.el10_1) to address these issues. The advisory references Red Hat Security Advisory RHSA-2026:3443 for detailed remediation instructions.
Potential Impact
The vulnerabilities allow attackers to tamper with data and cause denial of service conditions in Valkey, potentially disrupting applications relying on this key-value store. The improper null character handling in Lua scripts can lead to data integrity issues and service interruptions. The invalid clusterbus packet vulnerability can cause denial of service, affecting availability. No known exploits in the wild have been reported at this time.
Mitigation Recommendations
Red Hat has released an updated valkey package version 8.0.7-1.el10_1 that addresses these vulnerabilities. Users of Red Hat Enterprise Linux 10 should apply this update promptly following Red Hat's official guidance at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official patch.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:3443
- Cve Count
- 2
- Additional Cves
- ["CVE-2026-21863"]
- Cvss Version
- null
Threat ID: 6a160977e29bf47b50643bd8
Added to database: 05/26/2026, 20:58:31 UTC
Last enriched: 06/27/2026, 23:46:59 UTC
Last updated: 07/31/2026, 19:22:56 UTC
Views: 70
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.