SUSE-SU-2026:5092-1: Security update for valkey

Q: What access does an attacker need to trigger the heap buffer overflow?

The advisory states that an authenticated client could potentially execute arbitrary code by publishing an oversized cluster Pub/Sub message. It does not state the access requirements for the cluster bus parser out-of-bounds read.

Q: Which deployments should be prioritized for updating?

Prioritize Valkey installations using the SUSE Server Applications Module 15-SP7 packages, including valkey and suse/valkey-compat-redis. The advisory lists aarch64, ppc64le, s390x, and x86_64 builds.

Q: What version contains the documented security fixes?

The update moves Valkey to version 8.0.12, which includes the fix for the cluster Pub/Sub heap buffer overflow. The advisory also identifies a fix for CVE-2026-92925 in the cluster bus packet parser.

Published Nov 4, 2026

Updated

This update for valkey fixes the following issues:

- CVE-2026-92925: failure to properly validate string-carrying extensions for null-termination in the cluster bus packet parser can lead to an out-of-bounds read. - Integer truncation in Valkey cluster publish message construction causes a heap buffer overflow (bsc#1288118).

Update to 8.0.12: Security fixes:

(GHSA-f4q9-j22m-xqq9, bsc#1288118) Fix a heap buffer overflow in cluster Pub/Sub message construction that could allow an authenticated client to potentially execute arbitrary code by publishing an oversized message For full changelog see: https://github.com/valkey-io/valkey/releases/tag/8.0.12 https://github.com/valkey-io/valkey/releases/tag/8.0.11

Other sources

This update for valkey fixes the following issues: CVE-2026-92925: failure to properly validate string-carrying extensions for null-termination in the cluster bus packet parser can lead to an out-of-bounds read. Integer truncation in Valkey cluster publish message construction causes a heap buffer overflow (bsc#1288118). Update to 8.0.12: Security fixes: (GHSA-f4q9-j22m-xqq9, bsc#1288118) Fix a heap buffer overflow in cluster Pub/Sub message construction that could allow an authenticated client to potentially execute arbitrary code by publishing an oversized message For full changelog see: https://github.com/valkey-io/valkey/releases/tag/8.0.12 https://github.com/valkey-io/valkey/releases/tag/8.0.11

— SUSE

Affected Software

8 affected componentsFixes available

suse/valkey<8.0.12-150700.3.29.1

8.0.12-150700.3.29.1

All of the following

SUSE Server Applications Module 15-SP7 (aarch64 ppc64le s390x x86_64)

Any of the following

suse/valkey-debugsource<8.0.12-150700.3.29.1

8.0.12-150700.3.29.1

suse/valkey<8.0.12-150700.3.29.1

8.0.12-150700.3.29.1

suse/valkey-debuginfo<8.0.12-150700.3.29.1

8.0.12-150700.3.29.1

suse/valkey-devel<8.0.12-150700.3.29.1

8.0.12-150700.3.29.1

All of the following

SUSE Server Applications Module 15-SP7 (noarch)

suse/valkey-compat-redis<8.0.12-150700.3.29.1

8.0.12-150700.3.29.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade suse/valkey to a version that resolves this vulnerability.
Fixed in 8.0.12-150700.3.29.1
Upgrade
Upgrade suse/valkey-debugsource to a version that resolves this vulnerability.
Fixed in 8.0.12-150700.3.29.1
Upgrade
Upgrade suse/valkey-debuginfo to a version that resolves this vulnerability.
Fixed in 8.0.12-150700.3.29.1
Upgrade
Upgrade suse/valkey-devel to a version that resolves this vulnerability.
Fixed in 8.0.12-150700.3.29.1
Upgrade
Upgrade suse/valkey-compat-redis to a version that resolves this vulnerability.
Fixed in 8.0.12-150700.3.29.1
Upgrade
Upgrade valkey to a version that resolves this vulnerability.
Fixed in 8.0.12Patch SUSE-SLE-Module-Server-Applications-15-SP7-2026-5092

Event History

Nov 4, 2026

Advisory Published

via OSV·08:15 AM

Data Sourced

via OSV·08:15 AM

DescriptionAffected Software

Data Sourced

via SUSE·08:15 AM

RemedyDescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-92925

Frequently Asked Questions

What access does an attacker need to trigger the heap buffer overflow?

The advisory states that an authenticated client could potentially execute arbitrary code by publishing an oversized cluster Pub/Sub message. It does not state the access requirements for the cluster bus parser out-of-bounds read.

Which deployments should be prioritized for updating?

Prioritize Valkey installations using the SUSE Server Applications Module 15-SP7 packages, including valkey and suse/valkey-compat-redis. The advisory lists aarch64, ppc64le, s390x, and x86_64 builds.

What version contains the documented security fixes?

The update moves Valkey to version 8.0.12, which includes the fix for the cluster Pub/Sub heap buffer overflow. The advisory also identifies a fix for CVE-2026-92925 in the cluster bus packet parser.

SUSE-SU-2026:5092-1: Security update for valkey

Other sources

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What access does an attacker need to trigger the heap buffer overflow?

Which deployments should be prioritized for updating?

What version contains the documented security fixes?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to trigger the heap buffer overflow?

Which deployments should be prioritized for updating?

What version contains the documented security fixes?