Skip to content

Product

azure linux valkey vulnerabilities

23 published CVES affecting azure linux valkey, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
23
Critical
3
High
16
Medium
2
Low
2
Unscored
0
CISA KEV
0

Latest azure linux valkey CVEs

Newest publication first

  4. CVE-2026-66373 Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by mor...

    Published
    HighCVSS 7.5 EPSS 0.87%

    Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer, because deleting both consumers via XGROUP DELCONSUMER lead...

  8. CVE-2026-23631 redis-server Lua use-after-free may allow remote code execution

    Published
    MediumCVSS 6.1 EPSS 3.1%

    Redis is an in-memory data structure store. In all versions of redis-server with Lua scripting, an authenticated attacker can exploit the master-replica synchronization mechanism to trigger a use-after-free on replicas where replica-read-only is disabled or can be disabled, which...

  10. CVE-2026-27623 Valkey has Pre-Authentication DOS from malformed RESP request

    Published
    HighCVSS 7.5 EPSS 0.40%

    Valkey is a distributed key-value database. Starting in version 9.0.0 and prior to version 9.0.3, a malicious actor with network access to Valkey can cause the system to abort by triggering an assertion. When processing incoming requests, the Valkey system does not properly reset...

  11. CVE-2026-21863 Malformed Valkey Cluster bus message can lead to Remote DoS

    Published
    HighCVSS 7.5 EPSS 0.85%

    Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious actor with access to the Valkey clusterbus port can send an invalid packet that may cause an out bound read, which might result in the system crashing. The Valkey clusterbus...

  12. CVE-2025-67733 Valkey Affected by RESP Protocol Injection via Lua error_reply

    Published
    HighCVSS 7.1 EPSS 0.82%

    Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious user can use scripting commands to inject arbitrary information into the response stream for the given client, potentially corrupting or returning tampered data to other use...

  13. CVE-2025-49844 Redis Lua Use-After-Free may lead to remote code execution

    Published
    CriticalCVSS 9.9 EPSS 83.2%

    Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code execution. The problem e...

  14. CVE-2025-46819 Redis is vulnerable to DoS via specially crafted LUA scripts

    Published
    HighCVSS 7.1 EPSS 1.1%

    Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted LUA script to read out-of-bound data or crash the server and subsequent denial of service. The problem exists in all versions of Redi...

  17. CVE-2025-48367 Redis DoS Vulnerability due to bad connection error handling

    Published
    HighCVSS 7.5 EPSS 1.2%

    Redis is an open source, in-memory database that persists on disk. An unauthenticated connection can cause repeated IP protocol errors, leading to client starvation and, ultimately, a denial of service. This vulnerability is fixed in 8.0.3, 7.4.5, 7.2.10, and 6.2.19.

  20. CVE-2025-27151 redis-check-aof may lead to stack overflow and potential RCE

    Published
    CriticalCVSS 9.8 EPSS 1.1%

    Redis is an open source, in-memory database that persists on disk. In versions starting from 7.0.0 to before 8.0.2, a stack-based buffer overflow exists in redis-check-aof due to the use of memcpy with strlen(filepath) when copying a user-supplied file path into a fixed-size stac...

  22. CVE-2024-51741 Redis allows denial-of-service due to malformed ACL selectors

    Published
    MediumCVSS 4.4 EPSS 0.30%

    Redis is an open source, in-memory database that persists on disk. An authenticated with sufficient privileges may create a malformed ACL selector which, when accessed, triggers a server panic and subsequent denial of service. The problem is fixed in Redis 7.2.7 and 7.4.2.

  23. CVE-2024-46981 Redis' Lua library commands may lead to remote code execution

    Published
    CriticalCVSS 9.8 EPSS 8.2%

    Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to manipulate the garbage collector and potentially lead to remote code execution. The problem is fixed in 7.4.2, 7.2.7, and 6.2.17. An additional worka...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.