Stay Secure with the Latest Linux Advisories

security advisoryfedoracritical

Fedora 44 Valkey Critical Memory Access Risks CVE-2026-23479

Version 9.0.4 Security fixes (CVE-2026-23479) Use-After-Free in unblock client flow (CVE-2026-25243) Invalid Memory Access in RESTORE command (CVE-2026-23631) Use-after-free when full sync occurs during a yielding. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-3e31dafe5c 2026-05-18 00:40:49.528987+00:00 -------------------------------------------------------------------------------- Name : valkey Product : Fedora 44 Version : 9.0.4 Release : 1.fc44 URL : https://valkey.io Summary : A persistent key-value database Description : Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set. In order to achieve its outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log. Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth. Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave like a cache. You can use Valkey from most programming languages also. See https://valkey.io/topics/ -------------------------------------------------------------------------------- Update Information: Version 9.0.4 Security fixes (CVE-2026-23479) Use-After-Free in unblock client flow (CVE-2026-25243) Invalid Memory Access in RESTORE command (CVE-2026-23631) Use-after-free when full sync occurs during ayielding Lua/function execution -------------------------------------------------------------------------------- ChangeLog: * Wed May 6 2026 Remi Collet - 9.0.4-1 - Valkey 9.0.4 - May 5, 2026 - Upgrade urgency SECURITY: This release includes security fixes. CVE-2026-23479 CVE-2026-25243 CVE-2026-23631 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2477968 - CVE-2026-23479 valkey: use-after-free in unblock client flow may allow remote code execution [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2477968 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-3e31dafe5c' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list -- This email address is being protected from spambots. You need JavaScript enabled to view it. To unsubscribe send an email to This email address is being protected from spambots. You need JavaScript enabled to view it. Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it. Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new . Critical security advisory for Valkey in Fedora 44 addresses multiple vulnerabilities, including risky memory access.. Valkey, Fedora, security fixes, remote code execution, memory access. . Severity: Critical. LinuxSecurity.com Team

May 18, 2026 •Critical Fedora