Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious actor with access to the Valkey clusterbus port can send an invalid packet that may cause an out bound read, which might result in the system crashing. The Valkey clusterbus packet processing code does not validate that a clusterbus ping extension packet is located within buffer of the clusterbus packet before attempting to read it. Versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12 fix the issue. As an additional mitigation, don't expose the cluster bus connection directly to end users, and protect the connection with its own network ACLs.

redhat RHSA-2026:5445: RHSA-2026:5445: valkey security update (Important)

The remote Ubuntu 24.04 LTS / 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8106-1 advisory.

    It was discovered that Valkey incorrectly handled errors for lua scripts. An attacker could possibly use     this issue to inject arbitrary information into the response stream for other clients. (CVE-2025-67733)

    It was discovered that Valkey incorrectly handled malformed cluster bus messages. A remote attacker could     possibly use this issue to cause Valkey to crash, resulting in a denial of service. (CVE-2026-21863)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0848-1 advisory.

    Update to version 8.0.7.

    Security issues fixed:

    - CVE-2025-67733: data tampering and denial of service via improper null character handling in Lua scripts       (bsc#1258746).
    - CVE-2026-21863: denial of service via invalid clusterbus packet (bsc#1258788).

    Other updates and bugfixes:

      - ltrim should not call signalModifiedKey when no elements are removed (#2787)
      - chained replica crash when doing dual channel replication (#2983)
      - used_memory_dataset underflow due to miscalculated used_memory_overhead (#3005)
      - avoids crash during MODULE UNLOAD when ACL rules reference a module command and     subcommand (#3160)
      - server assert on ACL LOAD and resetchannels (#3182)
      - bug causing no response flush sometimes when IO threads are busy (#3205)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-ca1077dd2e advisory.

    **Valkey 9.0.3** - February 23, 2026

    Upgrade urgency SECURITY: This release includes security fixes we recommend you     apply as soon as possible.

    Security fixes

    * (**CVE-2025-67733**) RESP Protocol Injection via Lua error_reply
    * (**CVE-2026-21863**) Remote DoS with malformed Valkey Cluster bus message
    * (**CVE-2026-27623**) Reset request type after handling empty requests

    Bug fixes

    * Avoids crash during MODULE UNLOAD when ACL rules reference a module command and subcommand (#3160)
    * Fix server assert on ACL LOAD when current user loses permission to channels (#3182)
    * Fix bug causing no response flush sometimes when IO threads are busy (#3205)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1471 advisory.

    Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious     user can use scripting commands to inject arbitrary information into the response stream for the given     client, potentially corrupting or returning tampered data to other users on the same connection. The error     handling code for lua scripts does not properly handle null characters. Versions 9.0.2, 8.1.6, 8.0.7, and     7.2.12 fix the issue. (CVE-2025-67733)

    Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious     actor with access to the Valkey clusterbus port can send an invalid packet that may cause an out bound     read, which might result in the system crashing. The Valkey clusterbus packet processing code does not     validate that a clusterbus ping extension packet is located within buffer of the clusterbus packet before     attempting to read it. Versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12 fix the issue. As an additional     mitigation, don't expose the cluster bus connection directly to end users, and protect the connection with     its own network ACLs. (CVE-2026-21863)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:3507 advisory.

    * Valkey: Valkey: Data tampering and denial of service via improper null character handling in Lua scripts     (CVE-2025-67733)

    * valkey: Valkey: Denial of Service via invalid clusterbus packet (CVE-2026-21863)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:3443 advisory.

    * Valkey: Valkey: Data tampering and denial of service via improper null character handling in Lua scripts     (CVE-2025-67733)
      * valkey: Valkey: Denial of Service via invalid clusterbus packet (CVE-2026-21863)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-259:02 advisory.

    * Valkey: Valkey: Data tampering and denial of service via improper null character handling in Lua scripts     (CVE-2025-67733)
      * valkey: Valkey: Denial of Service via invalid clusterbus packet (CVE-2026-21863)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-1d05f1d152 advisory.

    **Valkey 8.0.7**  -  Released Mon 23 February 2026

    Upgrade urgency SECURITY: This release includes security fixes we recommend you     apply as soon as possible.

    Security fixes

    * (**CVE-2026-21863**) Remote DoS with malformed Valkey Cluster bus message
    * (**CVE-2025-67733**) RESP Protocol Injection via Lua error_reply

    Bug fixes

    * Fix ltrim should not call signalModifiedKey when no elements are removed (#2787)
    * Fix chained replica crash when doing dual channel replication (#2983)
    * Fix used_memory_dataset underflow due to miscalculated used_memory_overhead (#3005)
    * Avoids crash during MODULE UNLOAD when ACL rules reference a module command and subcommand (#3160)
    * Fix server assert on ACL LOAD and resetchannels (#3182)
    * Fix bug causing no response flush sometimes when IO threads are busy (#3205)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-8d275f4438 advisory.

    **Valkey 8.1.6**  -  Released Mon 23 February 2026

    Upgrade urgency SECURITY: This release includes security fixes we recommend you     apply as soon as possible.

    Security fixes

    * (**CVE-2026-21863**) Remote DoS with malformed Valkey Cluster bus message
    * (**CVE-2025-67733**) RESP Protocol Injection via Lua error_reply

    Bug fixes

    * Restrict ttl from being negative and avoid crash in import-mode (#2944)
    * Fix chained replica crash when doing dual channel replication (#2983)
    * Fix used_memory_dataset underflow due to miscalculated used_memory_overhead (#3005)
    * Fix crashing while MODULE UNLOAD when ACL rules reference a module command or subcommand (#3160)
    * Fix server assert on ACL LOAD and resetchannels (#3182)
    * Fix bug causing no response flush sometimes when IO threads are busy (#3205)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:3507 advisory.

    * Valkey: Valkey: Data tampering and denial of service via improper null character handling in Lua scripts     (CVE-2025-67733)
      * valkey: Valkey: Denial of Service via invalid clusterbus packet (CVE-2026-21863)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:3507 advisory.

    Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can     contain strings, hashes, lists, sets and sorted sets.  You can run atomic operations on these types, like     appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection,     union and difference; or getting the member with highest ranking in a sorted set.  In order to achieve its     outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can     persist it either by dumping the dataset to disk every once in a while, or by appending each command to a     log.  Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first     synchronization, auto-reconnection on net split and so forth.  Other features include Transactions,     Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave     like a cache.  You can use Valkey from most programming languages also.

    Security Fix(es):

    * Valkey: Valkey: Data tampering and denial of service via improper null character handling in Lua scripts     (CVE-2025-67733)

    * valkey: Valkey: Denial of Service via invalid clusterbus packet (CVE-2026-21863)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-3507 advisory.

    [8.0.7-1]
    - Rebase to 8.0.7 for CVE-2026-21863 CVE-2025-67733

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:3443 advisory.

    * Valkey: Valkey: Data tampering and denial of service via improper null character handling in Lua scripts     (CVE-2025-67733)

    * valkey: Valkey: Denial of Service via invalid clusterbus packet (CVE-2026-21863)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0685-1 advisory.

    Update to version 8.0.7.

    Security issues fixed:

    - CVE-2025-67733: data tampering and denial of service via improper null character handling in Lua scripts       (bsc#1258746).
    - CVE-2026-21863: denial of service via invalid clusterbus packet (bsc#1258788).

    Other updates and bugfixes:

      - ltrim should not call signalModifiedKey when no elements are removed (#2787)
      - chained replica crash when doing dual channel replication (#2983)
      - used_memory_dataset underflow due to miscalculated used_memory_overhead (#3005)
      - avoids crash during MODULE UNLOAD when ACL rules reference a module command and     subcommand (#3160)
      - server assert on ACL LOAD and resetchannels (#3182)
      - bug causing no response flush sometimes when IO threads are busy (#3205)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-3443 advisory.

    [8.0.7-1]
    - Rebase to 8.0.7 for CVE-2026-21863 CVE-2025-67733

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:3443 advisory.

    Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can     contain strings, hashes, lists, sets and sorted sets.  You can run atomic operations on these types, like     appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection,     union and difference; or getting the member with highest ranking in a sorted set.  In order to achieve its     outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can     persist it either by dumping the dataset to disk every once in a while, or by appending each command to a     log.  Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first     synchronization, auto-reconnection on net split and so forth.  Other features include Transactions,     Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave     like a cache.  You can use Valkey from most programming languages also.

    Security Fix(es):

    * Valkey: Valkey: Data tampering and denial of service via improper null character handling in Lua scripts     (CVE-2025-67733)

    * valkey: Valkey: Denial of Service via invalid clusterbus packet (CVE-2026-21863)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious     actor with access to the Valkey clusterbus port can send an invalid packet that may cause an out bound     read, which might result in the system crashing. The Valkey clusterbus packet processing code does not     validate that a clusterbus ping extension packet is located within buffer of the clusterbus packet before     attempting to read it. Versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12 fix the issue. As an additional     mitigation, don't expose the cluster bus connection directly to end users, and protect the connection with     its own network ACLs. (CVE-2026-21863)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
303032	Ubuntu 24.04 LTS / 25.10 : Valkey vulnerabilities (USN-8106-1)	Nessus	Ubuntu Local Security Checks	high
301804	SUSE SLES15 Security Update : valkey (SUSE-SU-2026:0848-1)	Nessus	SuSE Local Security Checks	high
301434	Fedora 44 : valkey (2026-ca1077dd2e)	Nessus	Fedora Local Security Checks	high
301338	Amazon Linux 2023 : valkey, valkey-devel (ALAS2023-2026-1471)	Nessus	Amazon Linux Local Security Checks	high
301121	RockyLinux 9 : valkey (RLSA-2026:3507)	Nessus	Rocky Linux Local Security Checks	high
301110	AlmaLinux 10 : valkey (ALSA-2026:3443)	Nessus	Alma Linux Local Security Checks	high
301101	MiracleLinux 9 : valkey-8.0.7-1.el9_7 (AXSA:2026-259:02)	Nessus	Miracle Linux Local Security Checks	high
301068	Fedora 42 : valkey (2026-1d05f1d152)	Nessus	Fedora Local Security Checks	high
301067	Fedora 43 : valkey (2026-8d275f4438)	Nessus	Fedora Local Security Checks	high
300981	AlmaLinux 9 : valkey (ALSA-2026:3507)	Nessus	Alma Linux Local Security Checks	high
300904	RHEL 9 : valkey (RHSA-2026:3507)	Nessus	Red Hat Local Security Checks	high
300808	Oracle Linux 9 : valkey (ELSA-2026-3507)	Nessus	Oracle Linux Local Security Checks	high
300805	RockyLinux 10 : valkey (RLSA-2026:3443)	Nessus	Rocky Linux Local Security Checks	high
300600	openSUSE 15 Security Update : valkey (SUSE-SU-2026:0685-1)	Nessus	SuSE Local Security Checks	high
300470	Oracle Linux 10 : valkey (ELSA-2026-3443)	Nessus	Oracle Linux Local Security Checks	high
300011	RHEL 10 : valkey (RHSA-2026:3443)	Nessus	Red Hat Local Security Checks	high
299879	Linux Distros Unpatched Vulnerability : CVE-2026-21863	Nessus	Misc.	high

Detections

Analytics

CVE-2026-21863

high

Tenable Plugins

Coming Soon

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high