valkey/valkey:9-alpine runs a from-source build (/usr/local/bin/valkey-server, v=9.1.2). Alpine v3.24
secdb valkey secfixes stop at 9.0.4-r0 and do not list these four ids, so there is no distro-side fix
version to compare against, and the GHSA index carries no patched-version field. Everything the secdb does
list (CVE-2024-31227/31228/31449, CVE-2025-21605, CVE-2025-49844, CVE-2025-67733, CVE-2026-21863,
CVE-2026-27623, CVE-2026-23479, CVE-2026-25243, CVE-2026-23631) is already fixed below 9.1.2.
Reachable only from the searxng container network.
Action: read each advisory page for its fixed version; if 9.1.2 is inside a range, move the image to a
build that carries the fix and pin it. The RDMA/Lua rows may be moot for this deployment (no RDMA, no
untrusted Lua) — record the reasoning either way.
**Severity:** 4 high — [CVE-2026-63639/GHSA-mvcj-73cw-22m4](https://github.com/valkey-io/valkey/security/advisories/GHSA-mvcj-73cw-22m4)
(UAF in stream deserialization → possible RCE), [CVE-2026-56684/GHSA-53mc-f3m3-99vh](https://github.com/valkey-io/valkey/security/advisories/GHSA-53mc-f3m3-99vh)
(UAF with TLS → possible RCE), [GHSA-jcj7-v34w-v9vv](https://github.com/valkey-io/valkey/security/advisories/GHSA-jcj7-v34w-v9vv)
(RDMA pending-data UAF), [GHSA-fq2f-crmw-q97r](https://github.com/valkey-io/valkey/security/advisories/GHSA-fq2f-crmw-q97r)
(unauthenticated Lua interpreter-state UAF) — applicability **unconfirmed**.
`valkey/valkey:9-alpine` runs a from-source build (`/usr/local/bin/valkey-server`, v=9.1.2). Alpine v3.24
secdb `valkey` secfixes stop at `9.0.4-r0` and do not list these four ids, so there is no distro-side fix
version to compare against, and the GHSA index carries no patched-version field. Everything the secdb does
list (CVE-2024-31227/31228/31449, CVE-2025-21605, CVE-2025-49844, CVE-2025-67733, CVE-2026-21863,
CVE-2026-27623, CVE-2026-23479, CVE-2026-25243, CVE-2026-23631) is already fixed below 9.1.2.
Reachable only from the `searxng` container network.
**Action:** read each advisory page for its fixed version; if 9.1.2 is inside a range, move the image to a
build that carries the fix and pin it. The RDMA/Lua rows may be moot for this deployment (no RDMA, no
untrusted Lua) — record the reasoning either way.
Source: [vuln-dankclaw.md](https://gitea.franksdank.cloud/dank/command-center/src/branch/main/omp-docs/reports/vuln-dankclaw.md) · audit [fleet-security-audit-2026-10-21.html](https://gitea.franksdank.cloud/dank/command-center/src/branch/main/omp-docs/reports/fleet-security-audit-2026-10-21.html)
---
cwd: /home/blank/.omp/wt/wt-20261019-125509-7c8a99d · session: 01a155bb-6474-7366-be9d-629f74af0e05
dank
self-assigned this 2026-10-21 15:59:09 -07:00
Taking ownership (agent). Reading the four GHSA pages for fixed versions; if 9.1.2 is in range, move searxng-valkey to a fixed build and pin it. Exposure is the searxng netns only.
**Taking ownership (agent).** Reading the four GHSA pages for fixed versions; if 9.1.2 is in range, move searxng-valkey to a fixed build and pin it. Exposure is the searxng netns only.
Resolved - not vulnerable. All four HIGH advisories are fixed at or below the running build: CVE-2026-63639 and CVE-2026-56684 fixed in 9.1.1 (we run 9.1.2); GHSA-jcj7-v34w-v9vv (RDMA) and GHSA-fq2f-crmw-q97r (Lua) are the two fixes the 9.1.2 SECURITY release itself shipped (valkey.io release notes). Repo action also landed: searxng-valkey.container is now digest-pinned (fleet law, tests/quadlet_image_pins.bats), so the build can no longer move under the service. Closing.
**Resolved - not vulnerable.** All four HIGH advisories are fixed at or below the running build: CVE-2026-63639 and CVE-2026-56684 fixed in 9.1.1 (we run 9.1.2); GHSA-jcj7-v34w-v9vv (RDMA) and GHSA-fq2f-crmw-q97r (Lua) are the two fixes the 9.1.2 SECURITY release itself shipped (valkey.io release notes). Repo action also landed: `searxng-valkey.container` is now digest-pinned (fleet law, `tests/quadlet_image_pins.bats`), so the build can no longer move under the service. Closing.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Severity: 4 high — CVE-2026-63639/GHSA-mvcj-73cw-22m4
(UAF in stream deserialization → possible RCE), CVE-2026-56684/GHSA-53mc-f3m3-99vh
(UAF with TLS → possible RCE), GHSA-jcj7-v34w-v9vv
(RDMA pending-data UAF), GHSA-fq2f-crmw-q97r
(unauthenticated Lua interpreter-state UAF) — applicability unconfirmed.
valkey/valkey:9-alpineruns a from-source build (/usr/local/bin/valkey-server, v=9.1.2). Alpine v3.24secdb
valkeysecfixes stop at9.0.4-r0and do not list these four ids, so there is no distro-side fixversion to compare against, and the GHSA index carries no patched-version field. Everything the secdb does
list (CVE-2024-31227/31228/31449, CVE-2025-21605, CVE-2025-49844, CVE-2025-67733, CVE-2026-21863,
CVE-2026-27623, CVE-2026-23479, CVE-2026-25243, CVE-2026-23631) is already fixed below 9.1.2.
Reachable only from the
searxngcontainer network.Action: read each advisory page for its fixed version; if 9.1.2 is inside a range, move the image to a
build that carries the fix and pin it. The RDMA/Lua rows may be moot for this deployment (no RDMA, no
untrusted Lua) — record the reasoning either way.
Source: vuln-dankclaw.md · audit fleet-security-audit-2026-10-21.html
cwd: /home/blank/.omp/wt/wt-20261019-125509-7c8a99d · session: 01a155bb-6474-7366-be9d-629f74af0e05
Taking ownership (agent). Reading the four GHSA pages for fixed versions; if 9.1.2 is in range, move searxng-valkey to a fixed build and pin it. Exposure is the searxng netns only.
Resolved - not vulnerable. All four HIGH advisories are fixed at or below the running build: CVE-2026-63639 and CVE-2026-56684 fixed in 9.1.1 (we run 9.1.2); GHSA-jcj7-v34w-v9vv (RDMA) and GHSA-fq2f-crmw-q97r (Lua) are the two fixes the 9.1.2 SECURITY release itself shipped (valkey.io release notes). Repo action also landed:
searxng-valkey.containeris now digest-pinned (fleet law,tests/quadlet_image_pins.bats), so the build can no longer move under the service. Closing.