Valkey is a distributed key-value database. Starting in version 9.0.0 and prior to version 9.0.3, a malicious actor with network access to Valkey can cause the system to abort by triggering an assertion. When processing incoming requests, the Valkey system does not properly reset the networking state after processing an empty request. A malicious actor can then send a request that the server incorrectly identifies as breaking server side invariants, which results in the server shutting down. Version 9.0.3 fixes the issue. As an additional mitigation, properly isolate Valkey deployments so that only trusted users have access.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious
    user can use scripting commands to inject arbitrary information into the response stream for the given
    client, potentially corrupting or returning tampered data to other users on the same connection. The error
    handling code for lua scripts does not properly handle null characters. Versions 9.0.2, 8.1.6, 8.0.7, and
    7.2.12 fix the issue. (CVE-2025-67733)

  - Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious
    actor with access to the Valkey clusterbus port can send an invalid packet that may cause an out bound
    read, which might result in the system crashing. The Valkey clusterbus packet processing code does not
    validate that a clusterbus ping extension packet is located within buffer of the clusterbus packet before
    attempting to read it. Versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12 fix the issue. As an additional
    mitigation, don't expose the cluster bus connection directly to end users, and protect the connection with
    its own network ACLs. (CVE-2026-21863)

  - Valkey is a distributed key-value database. Starting in version 9.0.0 and prior to version 9.0.3, a
    malicious actor with network access to Valkey can cause the system to abort by triggering an assertion.
    When processing incoming requests, the Valkey system does not properly reset the networking state after
    processing an empty request. A malicious actor can then send a request that the server incorrectly
    identifies as breaking server side invariants, which results in the server shutting down. Version 9.0.3
    fixes the issue. As an additional mitigation, properly isolate Valkey deployments so that only trusted
    users have access. (CVE-2026-27623)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-ca1077dd2e advisory.

    **Valkey 9.0.3** - February 23, 2026

    Upgrade urgency SECURITY: This release includes security fixes we recommend you     apply as soon as possible.

    Security fixes

    * (**CVE-2025-67733**) RESP Protocol Injection via Lua error_reply
    * (**CVE-2026-21863**) Remote DoS with malformed Valkey Cluster bus message
    * (**CVE-2026-27623**) Reset request type after handling empty requests

    Bug fixes

    * Avoids crash during MODULE UNLOAD when ACL rules reference a module command and subcommand (#3160)
    * Fix server assert on ACL LOAD when current user loses permission to channels (#3182)
    * Fix bug causing no response flush sometimes when IO threads are busy (#3205)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Valkey is a distributed key-value database. Starting in version 9.0.0 and prior to version 9.0.3, a     malicious actor with network access to Valkey can cause the system to abort by triggering an assertion.
    When processing incoming requests, the Valkey system does not properly reset the networking state after     processing an empty request. A malicious actor can then send a request that the server incorrectly     identifies as breaking server side invariants, which results in the server shutting down. Version 9.0.3     fixes the issue. As an additional mitigation, properly isolate Valkey deployments so that only trusted     users have access. (CVE-2026-27623)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
439497	Alpine: multiple valkey packages: security update to 9.0.3-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
439497	Alpine: multiple valkey packages: security update to 9.0.3-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
301434	Fedora 44 : valkey (2026-ca1077dd2e)	Nessus	Fedora Local Security Checks	high
299876	Linux Distros Unpatched Vulnerability : CVE-2026-27623	Nessus	Misc.	high

Detections

Analytics

CVE-2026-27623

high

Tenable Plugins

high

high

high

high