There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious
    user can use scripting commands to inject arbitrary information into the response stream for the given
    client, potentially corrupting or returning tampered data to other users on the same connection. The error
    handling code for lua scripts does not properly handle null characters. Versions 9.0.2, 8.1.6, 8.0.7, and
    7.2.12 fix the issue. (CVE-2025-67733)

  - Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious
    actor with access to the Valkey clusterbus port can send an invalid packet that may cause an out bound
    read, which might result in the system crashing. The Valkey clusterbus packet processing code does not
    validate that a clusterbus ping extension packet is located within buffer of the clusterbus packet before
    attempting to read it. Versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12 fix the issue. As an additional
    mitigation, don't expose the cluster bus connection directly to end users, and protect the connection with
    its own network ACLs. (CVE-2026-21863)

  - Valkey is a distributed key-value database. Starting in version 9.0.0 and prior to version 9.0.3, a
    malicious actor with network access to Valkey can cause the system to abort by triggering an assertion.
    When processing incoming requests, the Valkey system does not properly reset the networking state after
    processing an empty request. A malicious actor can then send a request that the server incorrectly
    identifies as breaking server side invariants, which results in the server shutting down. Version 9.0.3
    fixes the issue. As an additional mitigation, properly isolate Valkey deployments so that only trusted
    users have access. (CVE-2026-27623)

リモートの Fedora 44 ホストには、 FEDORA-2026-ca1077dd2e アドバイザリに記載された複数の脆弱性の影響を受けるパッケージがインストールされています。

    **Valkey 9.0.3** - 2026 年 2 月 23 日

    アップグレードの緊急性セキュリティ: このリリースにはセキュリティ修正が含まれています。可能な限り早急に適用することをお勧めします。

    セキュリティ修正

    * **CVE-2025-67733**Lua error_reply 経由の RESP プロトコルインジェクション
    * **CVE-2026-21863**無効な形式の Valkey Cluster バスメッセージによるリモート DoS
    * **CVE-2026-27623**空のリクエストの処理後にリクエストタイプをリセットします

    バグ修正

    * ACL ルールがモジュールコマンドおよびサブコマンドを参照する場合は、MODULE UNLOAD 中のクラッシュを回避します#3160
    * 現在のユーザーがチャネルに対する権限を失った場合、ACL LOAD でサーバーがアサートするのを修正します#3182
    * IO スレッドがビジーな場合に時々応答フラッシュが発生しないバグを修正します#3205

Tenable は、前述の記述ブロックを Fedora セキュリティアドバイザリから直接抽出しています。

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-ca1077dd2e advisory.

    **Valkey 9.0.3** - February 23, 2026

    Upgrade urgency SECURITY: This release includes security fixes we recommend you     apply as soon as possible.

    Security fixes

    * (**CVE-2025-67733**) RESP Protocol Injection via Lua error_reply
    * (**CVE-2026-21863**) Remote DoS with malformed Valkey Cluster bus message
    * (**CVE-2026-27623**) Reset request type after handling empty requests

    Bug fixes

    * Avoids crash during MODULE UNLOAD when ACL rules reference a module command and subcommand (#3160)
    * Fix server assert on ACL LOAD when current user loses permission to channels (#3182)
    * Fix bug causing no response flush sometimes when IO threads are busy (#3205)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
439497	Alpine: multiple valkey packages: security update to 9.0.3-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	2026/4/1	2026/7/2	high
439497	Alpine: multiple valkey packages: security update to 9.0.3-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	2026/4/1	2026/7/2	high
301434	Fedora 44valkey2026-ca1077dd2e	Nessus	Fedora Local Security Checks	2026/3/7	2026/3/7	high
301434	Fedora 44 : valkey (2026-ca1077dd2e)	Nessus	Fedora Local Security Checks	2026/3/7	2026/3/7	high

检测

插件搜索

high

high

high

high