Use-After-Free Vulnerability in Valkey Key-Value Database
CVE-2026-63639
8.8HIGH
What is CVE-2026-63639?
The Valkey distributed key-value database is susceptible to a use-after-free vulnerability due to its RESTORE command processing malformed RDB stream payloads. This flaw occurs when a Pending Entry List NACK is shared among multiple consumers during stream consumer-group deserialization. If one consumer is deleted while another references the shared NACK, it may lead to unexpected behavior, including the potential for remote code execution. The issue has been addressed in subsequent releases, including versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1.
Affected Version(s)
valkey < 7.2.14 < 7.2.14
valkey >= 8.0.0, < 8.0.10 < 8.0.0, 8.0.10
valkey >= 8.1.0, < 8.1.9 < 8.1.0, 8.1.9