SB2026090132 - Multiple vulnerabilities in Valkey

Description

This security bulletin contains information about 2 vulnerabilities.

1) Use-after-free (CVE-ID: N/A)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to execute arbitrary code or cause a denial of service.

The vulnerability exists due to use-after-free in the RDMA pending-data handler when processing pending data for RDMA connections. A remote user can run a command that frees another client\'s connection while pending data is being processed to execute arbitrary code or cause a denial of service.

Only servers built with RDMA support and configured with an RDMA listener are affected, and RDMA-capable hardware is required.

2) Use-after-free (CVE-ID: N/A)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to execute arbitrary code or cause a denial of service.

The vulnerability exists due to use-after-free in the script debugger command cache in the Lua interpreter state when running scripting commands and subsequent debugger commands. A remote user can trigger SCRIPT FLUSH ASYNC and then issue a debugger command to execute arbitrary code or cause a denial of service.

The issue was introduced when the Lua scripting engine was moved into a Valkey module.

Remediation

Install update from vendor's website.

References

• https://github.com/valkey-io/valkey/security/advisories/GHSA-jcj7-v34w-v9vv
• https://github.com/valkey-io/valkey/security/advisories/GHSA-fq2f-crmw-q97r