Nixpkgs security tracker

Login with GitHub

Details of issue NIXPKGS-2026-0307

NIXPKGS-2026-0307
published 6 months, 2 weeks ago
Permalink CVE-2026-27623
7.5 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): High (H)
updated 6 months, 2 weeks ago by @mweinelt Activity log
  • Created suggestion 6 months, 2 weeks ago
  • @mweinelt ignored
    5 packages
    • python312Packages.valkey
    • python313Packages.valkey
    • python314Packages.valkey
    • python313Packages.libvalkey
    • python314Packages.libvalkey
    6 months, 2 weeks ago
  • @mweinelt accepted 6 months, 2 weeks ago
  • @mweinelt published on GitHub 6 months, 2 weeks ago
Valkey has Pre-Authentication DOS from malformed RESP request

Valkey is a distributed key-value database. Starting in version 9.0.0 and prior to version 9.0.3, a malicious actor with network access to Valkey can cause the system to abort by triggering an assertion. When processing incoming requests, the Valkey system does not properly reset the networking state after processing an empty request. A malicious actor can then send a request that the server incorrectly identifies as breaking server side invariants, which results in the server shutting down. Version 9.0.3 fixes the issue. As an additional mitigation, properly isolate Valkey deployments so that only trusted users have access.

Affected products

valkey
  • ==>= 9.0.0, < 9.0.3

Matching in nixpkgs

pkgs.valkey

High-performance data structure server that primarily serves key/value workloads

Ignored packages (5)

Package maintainers

https://github.com/valkey-io/valkey/security/advisories/GHSA-93p9-5vc7-8wgr