SUSE-SU-2026:5102-1: Security update for valkey
This update for valkey fixes the following issues:
- Refresh patch for CVE-2026-92925: failure to properly validate string-carrying extensions for null-termination in the cluster bus packet parser can lead to an out-of-bounds read. - Integer truncation in Valkey cluster publish message construction causes a heap buffer overflow (bsc#1288118).
Update to 8.0.12. Security fixes:
(GHSA-f4q9-j22m-xqq9, bsc#1288118) Fix a heap buffer overflow in cluster Pub/Sub message construction that could allow an authenticated client to potentially execute arbitrary code by publishing an oversized message For full changelog see: https://github.com/valkey-io/valkey/releases/tag/8.0.12 https://github.com/valkey-io/valkey/releases/tag/8.0.11
Other sources
This update for valkey fixes the following issues: Refresh patch for CVE-2026-92925: failure to properly validate string-carrying extensions for null-termination in the cluster bus packet parser can lead to an out-of-bounds read. Integer truncation in Valkey cluster publish message construction causes a heap buffer overflow (bsc#1288118). Update to 8.0.12. Security fixes: (GHSA-f4q9-j22m-xqq9, bsc#1288118) Fix a heap buffer overflow in cluster Pub/Sub message construction that could allow an authenticated client to potentially execute arbitrary code by publishing an oversized message For full changelog see: https://github.com/valkey-io/valkey/releases/tag/8.0.12 https://github.com/valkey-io/valkey/releases/tag/8.0.11
— SUSE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
suse/valkeyto a version that resolves this vulnerability.Fixed in 8.0.12-150600.13.34.1 - Upgrade
Upgrade
suse/valkey-debuginfoto a version that resolves this vulnerability.Fixed in 8.0.12-150600.13.34.1 - Upgrade
Upgrade
suse/valkey-debugsourceto a version that resolves this vulnerability.Fixed in 8.0.12-150600.13.34.1 - Upgrade
Upgrade
suse/valkey-develto a version that resolves this vulnerability.Fixed in 8.0.12-150600.13.34.1 - Upgrade
Upgrade
suse/valkey-compat-redisto a version that resolves this vulnerability.Fixed in 8.0.12-150600.13.34.1 - Upgrade
Upgrade
valkeyto a version that resolves this vulnerability.Fixed in 8.0.12 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-2026-5102 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-5102 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES_SAP-15-SP6-2026-5102