Detections
Analytics
Alpine: multiple valkey packages: security update to 9.0.7-r0
high Tenable Cloud Security Plugin ID 478659
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's
tlsProcessPendingData function iterates pending_list while an authenticated client can trigger CLIENT
KILL, causing connTLSClose to delete the iterator's cached next node and producing a use-after-free that
can crash the server or potentially allow remote code execution when TLS is enabled. This issue is fixed
in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1. (CVE-2026-56684)
- Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's
RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to
multiple consumers during stream consumer-group deserialization, causing a use-after-free when one
consumer is deleted while another still references the shared NACK and potentially allowing remote code
execution. This issue is fixed in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1. (CVE-2026-63639)
Solution
Update the valkey library and its related packages to version 9.0.7-r0 or later.See Also
Plugin Details
Severity: High
ID: 478659
Version: Revision 1.1
Type: Local
Published: 11/9/2026
Updated: 11/9/2026
Supported Sensors: Agentless Assessment
Risk Information
VPR
Risk Factor: Medium
Score: 4.9
Percentile: 58.2
CVSS v2
Risk Factor: High
Base Score: 9
Temporal Score: 6.7
Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C
CVSS Score Source: CVE-2026-63639
CVSS v3
Risk Factor: High
Base Score: 8.8
Temporal Score: 7.7
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Vulnerability Publication Date: 7/22/2026
Reference Information
CVE: CVE-2026-56684, CVE-2026-63639