Skip to content
OpenAdvisories
High USN-8771-1 3 CVEs

valkey vulnerabilities

Published Sep 16, 2026 · Updated Sep 17, 2026

Ecosystem: Ubuntu

Summary

Madelyn Olson discovered that Valkey incorrectly handled TLS connections
under certain conditions. A remote attacker could possibly use this issue to
cause Valkey to crash, resulting in a denial of service, or execute arbitrary
code. (CVE-2026-56684)

It was discovered that Valkey incorrectly handled certain stream RDB payloads
when executing the RESTORE command. An authenticated remote attacker could
possibly use this issue to cause Valkey to crash, resulting in a denial
of service, or execute arbitrary code. (CVE-2026-63639)

It was discovered that Valkey incorrectly handled cluster slot migration
operations. A remote attacker could possibly use this issue to cause Valkey
to crash, resulting in a denial of service. This issue was only addressed in
Ubuntu 26.04 LTS. (CVE-2026-85522)

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 26.04 LTS 26.04:LTS valkey 9.0.4-0ubuntu0.2
Ubuntu · Pro 24.04 LTS Pro:24.04:LTS valkey 7.2.13+dfsg1-0ubuntu0.1+esm1

Vulnerabilities 3

  • High 8.8
    CVE-2026-63639

    Valkey: UAF in stream deserialization may lead to remote code execution

    Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deseriali…

    valkey-io valkey valkey valkey Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2026-56684

    Valkey: TLS pending-data processing use-after-free may allow remote code execution

    Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's tlsProcessPendingData function iterates pending_list while an authenticated client can trigger CLIENT KILL, causing connTLSClose to delete the iterator's ca…

    valkey-io valkey valkey valkey Debian Ubuntu Azure Linux Alpine
  • Medium 5.3
    CVE-2026-85522

    valkey-io valkey Slot Migration cluster_migrateslots.c createSlotImportJob out-of-bounds

    A vulnerability was detected in valkey-io valkey up to 9.5.4/9.1.0. Affected by this vulnerability is the function createSlotImportJob of the file src/cluster_migrateslots.c of the component Slot Migration. The manipulation of the argument job_name results in…

    valkey-io valkey valkey valkey Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2026-56684
  • report
    https://ubuntu.com/security/CVE-2026-63639
  • report
    https://ubuntu.com/security/CVE-2026-85522