Ubuntu alert USN-8106-1 (valkey)

From:
             
 
noreply+usn-bot@canonical.com
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-8106-1] Valkey vulnerabilities
Date:
             
 
Wed, 18 Mar 2026 14:00:51 +0000
Message-ID:
             
 
<E1w2rS7-0005Ru-WB@lists.ubuntu.com>
==========================================================================
Ubuntu Security Notice USN-8106-1
March 18, 2026

valkey vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 25.10
- Ubuntu 24.04 LTS

Summary:

Several security issues were fixed in Valkey.

Software Description:
- valkey: Persistent key-value database with network interface

Details:

It was discovered that Valkey incorrectly handled errors for lua scripts.
An attacker could possibly use this issue to inject arbitrary information
into the response stream for other clients. (CVE-2025-67733)

It was discovered that Valkey incorrectly handled malformed cluster bus
messages. A remote attacker could possibly use this issue to cause Valkey
to crash, resulting in a denial of service. (CVE-2026-21863)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 25.10
  valkey-server                   8.1.6+dfsg1-0ubuntu0.1

Ubuntu 24.04 LTS
  valkey-server                   7.2.12+dfsg1-0ubuntu0.1

This update uses a new upstream release, which includes additional bug
fixes. In general, a standard system update will make all the necessary
changes.

References:
  https://ubuntu.com/security/notices/USN-8106-1
  CVE-2025-67733, CVE-2026-21863

Package Information:
  https://launchpad.net/ubuntu/+source/valkey/8.1.6+dfsg1-0...
  https://launchpad.net/ubuntu/+source/valkey/7.2.12+dfsg1-...


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmm6r8AACgkQcpJm3tlz
hgH81g//S3WbegK+/iin8D7JNEq/XTv176x2B50NaJZEkuZa5zTSItTXvm0oTU6T
aVmTwMnhHbnqaZT9scTtyhIUt8P92T3IMobA2K3MpIywIsxDS/rMGNUJE1YAZKw0
X0WWv6lx5x6NroldLSewdoWhT7lBll/YHQS4NdA7iNUfnQ7sVL4jJ+XfiR4wlnpp
6MTcAXTA+WmOtLWT81RAWNB2wb2kUNQx8vqrDJSKJ/qHVSmuIu/rHSBzhbYH3uwc
uV1jdiyZImRrsNkt+RZ1Q8ZK20zR8tWqGuwM1q9EI4leUxlrdPfdSOg+yg8oZTnt
yZwVmRA4hmhESBI3GKC1Ofz7QXXFMLqzkqMMoRRx/2Rza4WrxEXbsggeuDDySgy4
D3X45pysqGx4sHD7jlWb9PJ7nr5rt8vuD8tvQ/oCVh7wtcE7At/DLn8bslZ2Mdn+
/kTW7lWdA9hFAW5kszvU4al1CJvcf6svGKTPGKeQDqeQmxKtjTNPs4C1t/VUEwim
AgmPAy9cqDqCAStdbbeWHydWE5M8NofY7fbzwH8ZM62hzPKBXVN8AkNIEYCQFi3L
p3ovcmwg4rbFsnQkpkJtL7U1FkcjuVuTajDAepczQfz75B3cYMKNqrBnlwLxt+L7
8jf3gsDz2sz5D2aLU9rj37pjPGPFweFEtzMdhHzPwyNcXDgQEF0=
=GeoZ
-----END PGP SIGNATURE-----