Threats Tagged 'cve-2026-21863'

Two security vulnerabilities have been identified in Valkey, an advanced key-value store used in Red Hat Enterprise Linux 10.0 Extended Update Support. The first vulnerability (CVE-2025-67733) involves data tampering and denial of service caused by improper handling of null characters in Lua scripts. The second vulnerability (CVE-2026-21863) allows denial of service via invalid clusterbus packets. Red Hat has issued an important security update addressing these issues. The update is available for multiple architectures and versions of Red Hat Enterprise Linux 10.0. No known exploits in the wild have been reported at this time.

Two security vulnerabilities have been identified in Valkey, an advanced key-value store used in Red Hat Enterprise Linux 10. The first vulnerability (CVE-2025-67733) involves data tampering and denial of service caused by improper null character handling in Lua scripts. The second vulnerability (CVE-2026-21863) allows denial of service via invalid clusterbus packets. Red Hat has issued a security update addressing these issues in Valkey version 8.0.7-1.el10_1 for multiple architectures. The update is rated as Important by Red Hat Product Security.

Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious actor with access to the Valkey clusterbus port can send an invalid packet that may cause an out bound read, which might result in the system crashing. The Valkey clusterbus packet processing code does not validate that a clusterbus ping extension packet is located within buffer of the clusterbus packet before attempting to read it. Versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12 fix the issue. As an additional mitigation, don't expose the cluster bus connection directly to end users, and protect the connection with its own network ACLs.

Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious user can use scripting commands to inject arbitrary information into the response stream for the given client, potentially corrupting or returning tampered data to other users on the same connection. The error handling code for lua scripts does not properly handle null characters. Versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12 fix the issue.

Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious actor with access to the Valkey clusterbus port can send an invalid packet that may cause an out bound read, which might result in the system crashing. The Valkey clusterbus packet processing code does not validate that a clusterbus ping extension packet is located within buffer of the clusterbus packet before attempting to read it. Versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12 fix the issue. As an additional mitigation, don't expose the cluster bus connection directly to end users, and protect the connection with its own network ACLs.