Detections
Analytics

Fedora 43 : valkey (2026-cda5ad190f)

high Nessus Plugin ID 344480

Language:

Synopsis

The remote Fedora host is missing one or more security updates.

Description

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-cda5ad190f advisory.

 ## Valkey 8.1.10 - Released Mon 31 August 2026

 Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible.

 ### Security Fixes

 * GHSA-jcj7-v34w-v9vv: Fix a use-after-free in RDMA connection handling that could allow an authenticated client to crash the server using CLIENT KILL. Only affects servers built with USE_RDMA and configured with an RDMA listener (#4534)

 ### Bug Fixes

 * Fix a double free when a module timer callback stops its own timer with `ValkeyModule_StopTimer` by @quanyeyang (#4211)
 * RESET now clears the `CLIENT IMPORT-SOURCE` flag so reused pooled connections stop reading logically expired keys by @tjade273 (#3973)
 * Fix AOF recovery of a truncated MULTI/EXEC block that could cause new writes to be lost after a subsequent restart by @chzhoo (#4342)
 * Fix an ACL bypass where duplicate STORE/STOREDIST options in GEORADIUS commands escaped key write permission checks by @tjade273 (#3971)
 * Fix a use-after-free crash when a cluster message of a module-registered type arrives after the module is unloaded by @enjoy-binbin (#4360)
 * Fix out-of-bounds access when registering or receiving cluster module messages of type 255, which is now fully supported by @enjoy-binbin (#4410)
 * Skip ACL permission checks when replaying the AOF, preventing silent data loss when users are restricted or disabled by @lukepalmer (#3984)
 * Fix a client memory accounting leak that inflated `mem_clients_normal` on replicas after disconnecting from the primary by @enjoy-binbin (#4395)
 * Always validate listpacks on RDB load and RESTORE to prevent deferred crashes; `sanitize-dump-payload` and the related ACL flags are now deprecated no-ops by @jjuleslasarte (#3721)
 * Fix a stack overflow crash when retrying large TLS writes after an OpenSSL write error by @murphyjacob4 (#4307)
 * Validate PUBLISH and MODULE cluster bus packet lengths, preventing a crash from forged packets with oversized payload lengths by @tjade273 (#3972)
 * Reject crafted stream RESTORE/RDB payloads with inconsistent lengths or negative field counts that could crash the server by @madolson (#3922)
 * Fix a use-after-free crash when serving multiple clients blocked on the same key if one is freed during processing by @quanyeyang (#4212)
 * Fix CLUSTER SLOT-STATS ORDERBY sorting when slot statistics differ by more than 2^31 by @jzy1688 (#4459)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected valkey package.

See Also

https://bodhi.fedoraproject.org/updates/FEDORA-2026-cda5ad190f

Plugin Details

Severity: High

ID: 344480

File Name: fedora_2026-cda5ad190f.nasl

Version: 1.1

Type: Local

Agent: unix

Published: 9/10/2026

Updated: 9/10/2026

Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus

Vulnerability Information

CPE: cpe:/o:fedoraproject:fedora:43, p-cpe:/a:fedoraproject:fedora:valkey

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 9/1/2026

Vulnerability Publication Date: 9/1/2026

Reference Information