Detections
Analytics
Alpine: multiple valkey packages: security update to 9.0.3-r0
high Tenable Cloud Security Plugin ID 439497
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious
user can use scripting commands to inject arbitrary information into the response stream for the given
client, potentially corrupting or returning tampered data to other users on the same connection. The error
handling code for lua scripts does not properly handle null characters. Versions 9.0.2, 8.1.6, 8.0.7, and
7.2.12 fix the issue. (CVE-2025-67733)
- Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious
actor with access to the Valkey clusterbus port can send an invalid packet that may cause an out bound
read, which might result in the system crashing. The Valkey clusterbus packet processing code does not
validate that a clusterbus ping extension packet is located within buffer of the clusterbus packet before
attempting to read it. Versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12 fix the issue. As an additional
mitigation, don't expose the cluster bus connection directly to end users, and protect the connection with
its own network ACLs. (CVE-2026-21863)
- Valkey is a distributed key-value database. Starting in version 9.0.0 and prior to version 9.0.3, a
malicious actor with network access to Valkey can cause the system to abort by triggering an assertion.
When processing incoming requests, the Valkey system does not properly reset the networking state after
processing an empty request. A malicious actor can then send a request that the server incorrectly
identifies as breaking server side invariants, which results in the server shutting down. Version 9.0.3
fixes the issue. As an additional mitigation, properly isolate Valkey deployments so that only trusted
users have access. (CVE-2026-27623)
Solution
Update the valkey library and its related packages to version 9.0.3-r0 or later.See Also
https://security.alpinelinux.org/vuln/CVE-2025-67733
Plugin Details
Severity: High
ID: 439497
Version: Revision 1.2
Type: Local
Published: 4/1/2026
Updated: 7/2/2026
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 3.5
Percentile: 51.86
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 5.9
Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:P/A:C
CVSS Score Source: CVE-2025-67733
CVSS v3
Risk Factor: High
Base Score: 7.1
Temporal Score: 6.4
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Vulnerability Publication Date: 2/23/2026