Lfprojects
Lfprojects Valkey: vulnerabilidades y CVE
Lfprojects Valkey tiene 12 vulnerabilidades publicadas, 10 de ellas en los últimos 12 meses. 1 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE12
Últimos 12 meses10
Críticas1
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-86227 | Baja (1.3) | 0.52% | — | 6 sept 2026 | A weakness has been identified in valkey-io valkey up to 9.0.5/9.1.1. This affects the function kvstoreGetHashtable of the file src/kvstore.c. This manipulation of the argument didx causes out-of-bounds read. It is… |
| CVE-2026-85522 | Media (5.5) | 0.86% | — | 4 sept 2026 | A vulnerability was detected in valkey-io valkey up to 9.5.4/9.1.0. Affected by this vulnerability is the function createSlotImportJob of the file src/cluster_migrateslots.c of the component Slot Migration. The… |
| CVE-2026-82677 | Baja (1.9) | 0.52% | — | 31 ago 2026 | A vulnerability was determined in valkey-io valkey 9.1.0. Impacted is the function moduleTimerHandler of the file src/module.c of the component Module Timer Subsystem. This manipulation causes double free. The attack… |
| CVE-2026-82631 | Baja (1.2) | 0.55% | — | 31 ago 2026 | A security flaw has been discovered in valkey-io valkey 9.1.0. The affected element is the function handleClientsBlockedOnKey of the file src/blocked.c of the component Blocked-on-keys Subsystem. The manipulation… |
| CVE-2026-63639 | Alta (8.8) | 1.2% | — | 18 ago 2026 | Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple… |
| CVE-2026-56684 | Alta (7.5) | 0.89% | — | 18 ago 2026 | Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's tlsProcessPendingData function iterates pending_list while an authenticated client can trigger CLIENT KILL, causing… |
| CVE-2026-27623 | Alta (7.5) | 0.65% | — | 23 feb 2026 | Valkey is a distributed key-value database. Starting in version 9.0.0 and prior to version 9.0.3, a malicious actor with network access to Valkey can cause the system to abort by triggering an assertion. When processing… |
| CVE-2026-21863 | Alta (7.5) | 0.78% | — | 23 feb 2026 | Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious actor with access to the Valkey clusterbus port can send an invalid packet that may cause an out bound read,… |
| CVE-2025-67733 | Alta (7.1) | 0.60% | — | 23 feb 2026 | Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious user can use scripting commands to inject arbitrary information into the response stream for the given client,… |
| CVE-2025-49844 | Crítica (9.9) | 82% | — | 3 oct 2025 | Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free… |
| CVE-2025-49112 | Baja (3.1) | 0.25% | — | 2 jun 2025 | setDeferredReply in networking.c in Valkey through 8.1.1 has an integer underflow for prev->size - prev->used. |
| CVE-2025-21605 | Alta (7.5) | 0.86% | — | 23 abr 2025 | Redis is an open source, in-memory database that persists on disk. In versions starting at 2.6 and prior to 7.4.3, An unauthenticated client can cause unlimited growth of output buffers, until the server runs out of… |