Amazon Linux 2023 Security Advisory: ALAS2023-2026-3265
Advisory Released Date: 2026-10-24
Advisory Updated Date: 2026-10-26
Severity:
Important
Issue Overview:
hiredis commit 29ea279 (post-v1.5.0) contains an uncontrolled memory allocation vulnerability in its RESP aggregate parser. (CVE-2026-88382)
A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-carrying extensions for null-termination. This oversight allows a remote attacker to craft a malicious packet, leading to an out-of-bounds read when the packet's payload is processed. Successful exploitation of this vulnerability could result in the disclosure of sensitive information or a remote denial of service (DoS). (CVE-2026-92925)
Affected Packages:
valkey
Issue Correction:
Run dnf update valkey --releasever 2023.12.20261026 or dnf update --advisory ALAS2023-2026-3265 --releasever 2023.12.20261026 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation
New Packages:
aarch64:
valkey-debuginfo-9.0.6-1.amzn2023.0.2.aarch64
valkey-devel-9.0.6-1.amzn2023.0.2.aarch64
valkey-9.0.6-1.amzn2023.0.2.aarch64
valkey-debugsource-9.0.6-1.amzn2023.0.2.aarch64
src:
valkey-9.0.6-1.amzn2023.0.2.src
x86_64:
valkey-debuginfo-9.0.6-1.amzn2023.0.2.x86_64
valkey-devel-9.0.6-1.amzn2023.0.2.x86_64
valkey-9.0.6-1.amzn2023.0.2.x86_64
valkey-debugsource-9.0.6-1.amzn2023.0.2.x86_64