Skip to content
OpenAdvisories
High RHSA-2026:64796 3 CVEs

Red Hat Security Advisory: valkey security, bug fix, and enhancement update

Published Sep 8, 2026 · Updated Sep 22, 2026

Ecosystem: Red Hat

Fixed packages 4

ReleasePackageFixed in
Red Hat · RHEL 10 enterprise_linux:10.2 valkey 0:8.0.11-1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 valkey-debuginfo 0:8.0.11-1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 valkey-debugsource 0:8.0.11-1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 valkey-devel 0:8.0.11-1.el10_2

Vulnerabilities 3

  • High 8.8
    CVE-2026-63639

    Valkey: UAF in stream deserialization may lead to remote code execution

    Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deseriali…

    valkey-io valkey valkey valkey Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2026-56684

    Valkey: TLS pending-data processing use-after-free may allow remote code execution

    Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's tlsProcessPendingData function iterates pending_list while an authenticated client can trigger CLIENT KILL, causing connTLSClose to delete the iterator's ca…

    valkey-io valkey valkey valkey Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2026-66373

    Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code executi…

    Redis Redis redis redis Debian Ubuntu Azure Linux

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2506985
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2517906
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2517907
  • article
    https://issues.redhat.com/browse/RHEL-216776
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_64796.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-56684
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-56684
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-56684
  • article
    https://github.com/valkey-io/valkey/commit/7cd5bcb7575d750ec2de618db80da58680a10fe3
  • article
    https://github.com/valkey-io/valkey/pull/4234
  • article
    https://github.com/valkey-io/valkey/releases/tag/7.2.14
  • article
    https://github.com/valkey-io/valkey/releases/tag/8.0.10
  • article
    https://github.com/valkey-io/valkey/releases/tag/8.1.9
  • article
    https://github.com/valkey-io/valkey/releases/tag/9.0.5
  • article
    https://github.com/valkey-io/valkey/releases/tag/9.1.1
  • article
    https://github.com/valkey-io/valkey/security/advisories/GHSA-53mc-f3m3-99vh
  • report
    https://access.redhat.com/security/cve/CVE-2026-63639
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-63639
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-63639
  • article
    https://github.com/valkey-io/valkey/commit/06bc7768fe609f2054e69ccedefe7628f5675da9
  • article
    https://github.com/valkey-io/valkey/commit/509cb3c74e8cbc9c0498ebe8b6c93dcd605e7271
  • article
    https://github.com/valkey-io/valkey/commit/98465eaffe3f95524a5046318bfbc4bdb9798291
  • article
    https://github.com/valkey-io/valkey/commit/e95911d4d65be8789fa3705f44d7ed1e65378445
  • article
    https://github.com/valkey-io/valkey/commit/f8d2027e8d4df790ac04974bf606408c8ea62778
  • article
    https://github.com/valkey-io/valkey/pull/4073
  • article
    https://github.com/valkey-io/valkey/security/advisories/GHSA-mvcj-73cw-22m4
  • report
    https://access.redhat.com/security/cve/CVE-2026-66373
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-66373
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-66373
  • article
    https://github.com/berabuddies/redis-poc
  • article
    https://github.com/redis/redis/compare/8.6.4...8.8.0
  • article
    https://github.com/redis/redis/pull/15081
  • article
    https://news.ycombinator.com/item?id=49024938
  • article
    https://x.com/Fried_rice/status/2080059356322918777