USN-8771-1: Valkey vulnerabilities

Valkey, the Linux Foundation's Redis-compatible distributed key-value database, contains a use-after-free (CWE-416) in its tlsProcessPendingData function on servers with TLS enabled. While that function iterates the TLS pending-data list, an authenticated client can issue CLIENT KILL, causing connTLSClose to delete the iterator's cached next node and triggering the memory-safety error. An attacker with low-privileged authenticated access can crash the server (denial of service) and potentially achieve remote code execution. All Valkey deployments on the 7.2, 8.0, 8.1, 9.0, and 9.1 branches prior to the fixed releases are affected, but only when TLS is enabled. No public proof-of-concept is known, the flaw is not in CISA's KEV catalog, EPSS estimates roughly a 0.5% chance of exploitation in the next 30 days, and Ubuntu has shipped fixes in USN-8771-1.

Do: Upgrade Valkey to 7.2.14, 8.0.10, 8.1.9, 9.0.5, or 9.1.1 depending on your branch, and apply Ubuntu's USN-8771-1 update if running the distro package. Until patched, restrict network access to the server, enforce strong authentication/ACLs so only trusted clients can connect, and limit or monitor use of CLIENT KILL, since triggering the bug requires an authenticated client. Verify whether your deployment runs with TLS enabled, as non-TLS instances are not affected.

Valkey, the Linux Foundation's open-source distributed key-value database and Redis fork, contains a use-after-free (CWE-416) in its processing of the RESTORE command. An authenticated client can supply a malformed RDB stream payload that, during stream consumer-group deserialization, assigns a single Pending Entry List NACK to multiple consumers; when one of those consumers is deleted while another still references the shared NACK, freed memory is reused, which can corrupt the server and potentially allows remote code execution. A successful attacker gains code execution on the Valkey server host with high impact on confidentiality, integrity, and availability (CVSS 3.1 score 8.8, network vector, low privileges required, no user interaction). All deployments running Valkey versions prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, or 9.1.1 are affected, including downstream distribution packages such as Ubuntu's valkey, for which Canonical issued USN-8771-1. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known, and EPSS currently estimates only a 0.9% probability of exploitation within 30 days.

Do: Upgrade Valkey to version 7.2.14, 8.0.10, 8.1.9, 9.0.5, or 9.1.1 depending on your release branch; Ubuntu users should apply the update from USN-8771-1. Because exploitation requires an authenticated client connection, restrict network access to the Valkey port, enforce authentication/ACLs, and limit which clients can issue RESTORE. Check running instances via the server banner or INFO command to confirm they are on a fixed version.