USN-7893-1: Valkey vulnerabilities
Benny Isaacs, Nir Brakha, and Sagi Tzadik discovered that Valkey incorrectly handled memory when running Lua scripts. An authenticated attacker could use this vulnerability to trigger a use-after-free condition, and potentially achieve remote code execution on the Valkey server. (CVE-2025-49844) It was discovered that Valkey incorrectly handled memory when running Lua scripts. An authenticated attacker could use this vulnerability to trigger a integer overflow condition, and potentially achieve remote code execution on the Valkey server. (CVE-2025-46817) It was discovered that Valkey incorrectly handled Lua objects. An authenticated attacker could possibly use this issue to escalate their privileges. (CVE-2025-46818) It was discovered that Valkey incorrectly handled memory when running Lua scripts. An authenticated attacker could use this vulnerability to read out-of-bounds memory, causing a denial of service or possibly obtaining sensitive information. (CVE-2025-46819) It was discovered that Valkey incorrectly handled memory in some calculations. An attacker could possibly use this issue to cause a denial of service. (CVE-2025-49112)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/valkey-serverto a version that resolves this vulnerability.Fixed in 8.1.4+dfsg1-0ubuntu0.2 - Upgrade
Upgrade
ubuntu/valkey-serverto a version that resolves this vulnerability.Fixed in 8.0.6+dfsg1-0ubuntu0.2 - Upgrade
Upgrade
ubuntu/valkey-serverto a version that resolves this vulnerability.Fixed in 7.2.11+dfsg1-0ubuntu0.2
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Who can exploit the Lua-script vulnerabilities?
The use-after-free, integer overflow, and out-of-bounds memory issues are described as exploitable by an authenticated attacker. Systems where untrusted or lower-privileged users can authenticate to Valkey and run Lua scripts are therefore exposed to those attack paths.
What impact is possible if the Lua issues are exploited?
CVE-2025-49844 and CVE-2025-46817 could potentially allow remote code execution on the Valkey server. CVE-2025-46819 can cause denial of service or possibly disclose sensitive information, while CVE-2025-46818 may permit privilege escalation and CVE-2025-49112 may cause denial of service.
What should be prioritized if an update cannot be applied immediately?
Restrict Valkey authentication and access to trusted users, since several issues require an authenticated attacker. In particular, limit the ability of untrusted users to execute Lua scripts until the affected server can be updated.