Log in Start free

Vulnerability · Published Aug 18, 2026 · Assigned by GitHub_M

CVE-2026-56684Valkey: TLS pending-data processing use-after-free may allow remote code execution

High 7.5

In plain English

A high-severity use-after-free in valkey from valkey-io. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.5%top 55.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's tlsProcessPendingData function iterates pending_list while an authenticated client can trigger CLIENT KILL, causing connTLSClose to delete the iterator's cached next node and producing a use-after-free that can crash the server or potentially allow remote code execution when TLS is enabled. This issue is fixed in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10valkey8.0.11-1.el10_2ALSA-2026:64796
AlmaLinux:9valkey8.0.10-1.el9_8ALSA-2026:64807
AlmaLinux:10valkey-devel8.0.11-1.el10_2ALSA-2026:64796
AlmaLinux:9valkey-devel8.0.10-1.el9_8ALSA-2026:64807
Debian:14redictno fix listedDEBIAN-CVE-2026-56684
Debian:13valkey8.1.1+dfsg1-3+deb13u3DEBIAN-CVE-2026-56684
Debian:14valkey9.1.1-1DEBIAN-CVE-2026-56684
Rocky Linux:10valkey0:8.0.11-1.el10_2RLSA-2026:64796
Rocky Linux:9valkey0:8.0.10-1.el9_8RLSA-2026:64807
Ubuntu:26.04:LTSvalkey9.0.4-0ubuntu0.2USN-8771-1
Ubuntu:26.04:LTSvalkey9.0.4-0ubuntu0.2UBUNTU-CVE-2026-56684

Affected products (as reported)

VendorProductVersions
valkey-io valkey < 7.2.14>= 8.0.0, < 8.0.10>= 8.1.0, < 8.1.9>= 9.0.0, < 9.0.5>= 9.1.0, < 9.1.1

Weakness: CWE-416 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References