valkey
A persistent key-value database
- Current
- 8.1.4
- Candidate
- 9.1.3Stale
- License
- BSD-3-Clause AND BSD-2-Clause AND MIT AND BSL-1.0
Advisory · 4
Provider matches do not establish RPM applicability. Local patches, bundled dependencies and binary artifacts are not evaluated.
- Summary
- Valkey Affected by RESP Protocol Injection via Lua error_replyOSV
- Fixed events
- 19b07dfcbb75b14a1ed1b0a48cb8a0efcc81d563, 1ac4cfe4c877a6cb8cb2e28fa7094055ac06f64b, 7b696d1a4f8b2a5b5393dba7c6706f7aa8599013, d77c7aaf01d273d2480aeabf5ed578aa0133d9a1OSV
- EPSS model date
- 2026-11-10FIRST
- EPSS probability
- 0.647%FIRST
- Aliases
- BIT-valkey-2025-67733, GHSA-p876-p7q5-hv2mOSV
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:HOSV
- Summary
- Malformed Valkey Cluster bus message can lead to Remote DoSOSV
- Fixed events
- 19b07dfcbb75b14a1ed1b0a48cb8a0efcc81d563, 1ac4cfe4c877a6cb8cb2e28fa7094055ac06f64b, 7b696d1a4f8b2a5b5393dba7c6706f7aa8599013, d77c7aaf01d273d2480aeabf5ed578aa0133d9a1OSV
- EPSS model date
- 2026-11-10FIRST
- EPSS probability
- 0.848%FIRST
- Aliases
- BIT-valkey-2026-21863, GHSA-c677-q3wr-gggqOSV
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HOSV
- Summary
- Valkey: TLS pending-data processing use-after-free may allow remote code executionOSV
- Fixed events
- 23b3f6bb66c19502225a40e7aeec9e1be76456c1, 499cfb9431c7cebec4d91f81bb4932a742a8c8ae, 7cd5bcb7575d750ec2de618db80da58680a10fe3, a253513ac7ff5790ca119053f3c7fbca4fdaad44, a9245aaf3286dee1795763661f0da6886acd8ef4, d27f9ba65a04e80d9c417112a7621fc98a56f70dOSV
- EPSS model date
- 2026-11-10FIRST
- EPSS probability
- 0.523%FIRST
- Aliases
- BIT-valkey-2026-56684, GHSA-53mc-f3m3-99vhOSV
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HOSV
- Summary
- Valkey: UAF in stream deserialization may lead to remote code executionOSV
- Fixed events
- 06bc7768fe609f2054e69ccedefe7628f5675da9, 23b3f6bb66c19502225a40e7aeec9e1be76456c1, 499cfb9431c7cebec4d91f81bb4932a742a8c8ae, 509cb3c74e8cbc9c0498ebe8b6c93dcd605e7271, 98465eaffe3f95524a5046318bfbc4bdb9798291, a253513ac7ff5790ca119053f3c7fbca4fdaad44, a9245aaf3286dee1795763661f0da6886acd8ef4, d27f9ba65a04e80d9c417112a7621fc98a56f70d, e95911d4d65be8789fa3705f44d7ed1e65378445, f8d2027e8d4df790ac04974bf606408c8ea62778OSV
- EPSS model date
- 2026-11-10FIRST
- EPSS probability
- 0.888%FIRST
- Aliases
- BIT-valkey-2026-63639, GHSA-mvcj-73cw-22m4OSV
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOSV
- Additional references
- 2OSV
Description
Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set. In order to achieve its outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log. Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth. Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave like a cache. You can use Valkey from most programming languages also. See https://valkey.io/topics/
Changelog
PR · 3
Checks
| Monitor | Observation | Last checked |
|---|---|---|
Stale Repository refresh: git fetch exited 128 (authentication) | ||
Stale Source last confirmed at 2026-11-12T12:09:42+00:00; repository refresh overdue. | ||
Checked | ||
Checked | ||
Checked Current source cycle 8.1; upstream lifecycle only. | ||
Not configured No reliable monitor identity/configuration. | — | |
Not configured No reliable monitor identity/configuration. | — | |
Checked Repository query; subpackage and local-patch applicability are not evaluated. | Last attempted | |
Not configured No reliable monitor identity/configuration. | — |