Vulnerability-Lookup

RHSA-2026:61884

Vulnerability from csaf_redhat - Published: 2026-09-01 05:42 - Updated: 2026-09-21 11:43

Summary

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Severity

Important

Notes

Topic: An update for Red Hat Hardened Images RPMs is now available.

Details: This update includes the following RPMs: valkey: * valkey-9.0.6-0.1.hum1 (aarch64, x86_64) * valkey-compat-redis-9.0.6-0.1.hum1 (noarch) * valkey-compat-redis-devel-9.0.6-0.1.hum1 (noarch) * valkey-devel-9.0.6-0.1.hum1 (aarch64, x86_64) * valkey-doc-9.0.6-0.1.hum1 (noarch) * valkey-rdma-9.0.6-0.1.hum1 (aarch64, x86_64) * valkey-9.0.6-0.1.hum1.src (src)

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-56684

A flaw was found in Valkey. An authenticated client can trigger a `CLIENT KILL` command while the `tlsProcessPendingData` function iterates a pending list. This action causes `connTLSClose` to delete the iterator's cached next node, leading to a use-after-free vulnerability. This flaw, when Transport Layer Security (TLS) is enabled, may result in a server crash or potentially allow a remote attacker to achieve arbitrary code execution.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 13 products

Product	Version	Remediation
Unresolved product id: Red Hat Hardened Images:valkey-0:9.0.6-0.1.hum1@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:valkey-0:9.0.6-0.1.hum1@src	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:valkey-0:9.0.6-0.1.hum1@x86_64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:valkey-compat-redis-0:9.0.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:valkey-compat-redis-0:9.0.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:valkey-compat-redis-devel-0:9.0.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:valkey-compat-redis-devel-0:9.0.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:valkey-devel-0:9.0.6-0.1.hum1@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:valkey-devel-0:9.0.6-0.1.hum1@x86_64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:valkey-doc-0:9.0.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:valkey-doc-0:9.0.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:valkey-rdma-0:9.0.6-0.1.hum1@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:valkey-rdma-0:9.0.6-0.1.hum1@x86_64	—	Vendor Fix fix Workaround

Threats

Impact Important

CVE-2026-63639

A flaw was found in Valkey, a distributed key-value database. A remote attacker could exploit a use-after-free vulnerability in the RESTORE command. This occurs when a malformed data stream is processed during stream deserialization, causing a shared resource to be improperly managed. If successfully exploited, this flaw could lead to remote code execution.

8.8 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 13 products, the same list as for CVE-2026-56684

Threats

Impact Important

CVE-2026-82631

A flaw was found in Valkey. A use-after-free vulnerability exists within the `handleClientsBlockedOnKey` function of the Blocked-on-keys Subsystem. A remote attacker could exploit this flaw, leading to a denial of service. The complexity of exploiting this vulnerability is high.

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 13 products, the same list as for CVE-2026-56684

Threats

Impact Low

CVE-2026-82677

A flaw was found in valkey-io valkey. A remote attacker could exploit a double free vulnerability in the `moduleTimerHandler` function within the Module Timer subsystem (src/module.c). This flaw could lead to a denial of service.

4.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-1341 - Multiple Releases of Same Resource or Handle

Affected products

Fixed 13 products, the same list as for CVE-2026-56684

Threats

Impact Moderate

References

58 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:61884	self
https://images.redhat.com/	external
https://access.redhat.com/security/cve/CVE-2026-85522	external
https://access.redhat.com/security/updates/classi…	external
https://access.redhat.com/security/cve/CVE-2026-86227	external
https://access.redhat.com/security/cve/CVE-2026-56684	external
https://access.redhat.com/security/cve/CVE-2026-63639	external
https://access.redhat.com/security/cve/CVE-2026-82677	external
https://access.redhat.com/security/cve/CVE-2026-82631	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-56684	self
https://bugzilla.redhat.com/show_bug.cgi?id=2517907	external
https://www.cve.org/CVERecord?id=CVE-2026-56684	external
https://nvd.nist.gov/vuln/detail/CVE-2026-56684	external
https://github.com/valkey-io/valkey/commit/7cd5bc…	external
https://github.com/valkey-io/valkey/pull/4234	external
https://github.com/valkey-io/valkey/releases/tag/7.2.14	external
https://github.com/valkey-io/valkey/releases/tag/8.0.10	external
https://github.com/valkey-io/valkey/releases/tag/8.1.9	external
https://github.com/valkey-io/valkey/releases/tag/9.0.5	external
https://github.com/valkey-io/valkey/releases/tag/9.1.1	external
https://github.com/valkey-io/valkey/security/advi…	external
https://access.redhat.com/security/cve/CVE-2026-63639	self
https://bugzilla.redhat.com/show_bug.cgi?id=2517906	external
https://www.cve.org/CVERecord?id=CVE-2026-63639	external
https://nvd.nist.gov/vuln/detail/CVE-2026-63639	external
https://github.com/valkey-io/valkey/commit/06bc77…	external
https://github.com/valkey-io/valkey/commit/509cb3…	external
https://github.com/valkey-io/valkey/commit/98465e…	external
https://github.com/valkey-io/valkey/commit/e95911…	external
https://github.com/valkey-io/valkey/commit/f8d202…	external
https://github.com/valkey-io/valkey/pull/4073	external
https://github.com/valkey-io/valkey/security/advi…	external
https://access.redhat.com/security/cve/CVE-2026-82631	self
https://bugzilla.redhat.com/show_bug.cgi?id=2526157	external
https://www.cve.org/CVERecord?id=CVE-2026-82631	external
https://nvd.nist.gov/vuln/detail/CVE-2026-82631	external
https://github.com/user-attachments/files/3011162…	external
https://github.com/valkey-io/valkey/	external
https://github.com/valkey-io/valkey/commit/b2fb0e…	external
https://github.com/valkey-io/valkey/issues/4198	external
https://github.com/valkey-io/valkey/pull/4212	external
https://vuldb.com/cve/CVE-2026-82631	external
https://vuldb.com/submit/893793	external
https://vuldb.com/vuln/397129	external
https://vuldb.com/vuln/397129/cti	external
https://access.redhat.com/security/cve/CVE-2026-82677	self
https://bugzilla.redhat.com/show_bug.cgi?id=2526233	external
https://www.cve.org/CVERecord?id=CVE-2026-82677	external
https://nvd.nist.gov/vuln/detail/CVE-2026-82677	external
https://github.com/user-attachments/files/3011880…	external
https://github.com/valkey-io/valkey/commit/b349fe…	external
https://github.com/valkey-io/valkey/issues/4200	external
https://github.com/valkey-io/valkey/pull/4211	external
https://vuldb.com/cve/CVE-2026-82677	external
https://vuldb.com/submit/893959	external
https://vuldb.com/vuln/397172	external
https://vuldb.com/vuln/397172/cti	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\nvalkey:\n  * valkey-9.0.6-0.1.hum1 (aarch64, x86_64)\n  * valkey-compat-redis-9.0.6-0.1.hum1 (noarch)\n  * valkey-compat-redis-devel-9.0.6-0.1.hum1 (noarch)\n  * valkey-devel-9.0.6-0.1.hum1 (aarch64, x86_64)\n  * valkey-doc-9.0.6-0.1.hum1 (noarch)\n  * valkey-rdma-9.0.6-0.1.hum1 (aarch64, x86_64)\n  * valkey-9.0.6-0.1.hum1.src (src)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:61884",
        "url": "https://access.redhat.com/errata/RHSA-2026:61884"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-85522",
        "url": "https://access.redhat.com/security/cve/CVE-2026-85522"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-86227",
        "url": "https://access.redhat.com/security/cve/CVE-2026-86227"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56684",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56684"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-63639",
        "url": "https://access.redhat.com/security/cve/CVE-2026-63639"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-82677",
        "url": "https://access.redhat.com/security/cve/CVE-2026-82677"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-82631",
        "url": "https://access.redhat.com/security/cve/CVE-2026-82631"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_61884.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
    "tracking": {
      "current_release_date": "2026-09-21T11:43:42+00:00",
      "generator": {
        "date": "2026-09-21T11:43:42+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.0"
        }
      },
      "id": "RHSA-2026:61884",
      "initial_release_date": "2026-09-01T05:42:50+00:00",
      "revision_history": [
        {
          "date": "2026-09-01T05:42:50+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-16T10:08:25+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-09-21T11:43:42+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "valkey-0:9.0.6-0.1.hum1@aarch64",
                "product": {
                  "name": "valkey-0:9.0.6-0.1.hum1@aarch64",
                  "product_id": "valkey-0:9.0.6-0.1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/valkey@9.0.6-0.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "valkey-devel-0:9.0.6-0.1.hum1@aarch64",
                "product": {
                  "name": "valkey-devel-0:9.0.6-0.1.hum1@aarch64",
                  "product_id": "valkey-devel-0:9.0.6-0.1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/valkey-devel@9.0.6-0.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "valkey-rdma-0:9.0.6-0.1.hum1@aarch64",
                "product": {
                  "name": "valkey-rdma-0:9.0.6-0.1.hum1@aarch64",
                  "product_id": "valkey-rdma-0:9.0.6-0.1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/valkey-rdma@9.0.6-0.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "valkey-0:9.0.6-0.1.hum1@src",
                "product": {
                  "name": "valkey-0:9.0.6-0.1.hum1@src",
                  "product_id": "valkey-0:9.0.6-0.1.hum1@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/valkey@9.0.6-0.1.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "valkey-0:9.0.6-0.1.hum1@x86_64",
                "product": {
                  "name": "valkey-0:9.0.6-0.1.hum1@x86_64",
                  "product_id": "valkey-0:9.0.6-0.1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/valkey@9.0.6-0.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "valkey-devel-0:9.0.6-0.1.hum1@x86_64",
                "product": {
                  "name": "valkey-devel-0:9.0.6-0.1.hum1@x86_64",
                  "product_id": "valkey-devel-0:9.0.6-0.1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/valkey-devel@9.0.6-0.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "valkey-rdma-0:9.0.6-0.1.hum1@x86_64",
                "product": {
                  "name": "valkey-rdma-0:9.0.6-0.1.hum1@x86_64",
                  "product_id": "valkey-rdma-0:9.0.6-0.1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/valkey-rdma@9.0.6-0.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "valkey-compat-redis-0:9.0.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                "product": {
                  "name": "valkey-compat-redis-0:9.0.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_id": "valkey-compat-redis-0:9.0.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/valkey-compat-redis@9.0.6-0.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "valkey-compat-redis-0:9.0.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                "product": {
                  "name": "valkey-compat-redis-0:9.0.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_id": "valkey-compat-redis-0:9.0.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/valkey-compat-redis@9.0.6-0.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "valkey-compat-redis-devel-0:9.0.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                "product": {
                  "name": "valkey-compat-redis-devel-0:9.0.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_id": "valkey-compat-redis-devel-0:9.0.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/valkey-compat-redis-devel@9.0.6-0.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "valkey-compat-redis-devel-0:9.0.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                "product": {
                  "name": "valkey-compat-redis-devel-0:9.0.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_id": "valkey-compat-redis-devel-0:9.0.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/valkey-compat-redis-devel@9.0.6-0.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "valkey-doc-0:9.0.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                "product": {
                  "name": "valkey-doc-0:9.0.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_id": "valkey-doc-0:9.0.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/valkey-doc@9.0.6-0.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "valkey-doc-0:9.0.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                "product": {
                  "name": "valkey-doc-0:9.0.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_id": "valkey-doc-0:9.0.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/valkey-doc@9.0.6-0.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "valkey-0:9.0.6-0.1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:valkey-0:9.0.6-0.1.hum1@aarch64"
        },
        "product_reference": "valkey-0:9.0.6-0.1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "valkey-0:9.0.6-0.1.hum1@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:valkey-0:9.0.6-0.1.hum1@src"
        },
        "product_reference": "valkey-0:9.0.6-0.1.hum1@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "valkey-0:9.0.6-0.1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:valkey-0:9.0.6-0.1.hum1@x86_64"
        },
        "product_reference": "valkey-0:9.0.6-0.1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "valkey-compat-redis-0:9.0.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:valkey-compat-redis-0:9.0.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms"
        },
        "product_reference": "valkey-compat-redis-0:9.0.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "valkey-compat-redis-0:9.0.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:valkey-compat-redis-0:9.0.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        },
        "product_reference": "valkey-compat-redis-0:9.0.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "valkey-compat-redis-devel-0:9.0.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:valkey-compat-redis-devel-0:9.0.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms"
        },
        "product_reference": "valkey-compat-redis-devel-0:9.0.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "valkey-compat-redis-devel-0:9.0.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:valkey-compat-redis-devel-0:9.0.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        },
        "product_reference": "valkey-compat-redis-devel-0:9.0.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "valkey-devel-0:9.0.6-0.1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:valkey-devel-0:9.0.6-0.1.hum1@aarch64"
        },
        "product_reference": "valkey-devel-0:9.0.6-0.1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "valkey-devel-0:9.0.6-0.1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:valkey-devel-0:9.0.6-0.1.hum1@x86_64"
        },
        "product_reference": "valkey-devel-0:9.0.6-0.1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "valkey-doc-0:9.0.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:valkey-doc-0:9.0.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms"
        },
        "product_reference": "valkey-doc-0:9.0.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "valkey-doc-0:9.0.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:valkey-doc-0:9.0.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        },
        "product_reference": "valkey-doc-0:9.0.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "valkey-rdma-0:9.0.6-0.1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:valkey-rdma-0:9.0.6-0.1.hum1@aarch64"
        },
        "product_reference": "valkey-rdma-0:9.0.6-0.1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "valkey-rdma-0:9.0.6-0.1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:valkey-rdma-0:9.0.6-0.1.hum1@x86_64"
        },
        "product_reference": "valkey-rdma-0:9.0.6-0.1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-56684",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-08-18T14:31:30.007665+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2517907"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Valkey. An authenticated client can trigger a `CLIENT KILL` command while the `tlsProcessPendingData` function iterates a pending list. This action causes `connTLSClose` to delete the iterator\u0027s cached next node, leading to a use-after-free vulnerability. This flaw, when Transport Layer Security (TLS) is enabled, may result in a server crash or potentially allow a remote attacker to achieve arbitrary code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "valkey: Valkey: Remote code execution via TLS pending-data processing use-after-free",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:valkey-0:9.0.6-0.1.hum1@aarch64",
          "Red Hat Hardened Images:valkey-0:9.0.6-0.1.hum1@src",
          "Red Hat Hardened Images:valkey-0:9.0.6-0.1.hum1@x86_64",
          "Red Hat Hardened Images:valkey-compat-redis-0:9.0.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:valkey-compat-redis-0:9.0.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:valkey-compat-redis-devel-0:9.0.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:valkey-compat-redis-devel-0:9.0.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:valkey-devel-0:9.0.6-0.1.hum1@aarch64",
          "Red Hat Hardened Images:valkey-devel-0:9.0.6-0.1.hum1@x86_64",
          "Red Hat Hardened Images:valkey-doc-0:9.0.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:valkey-doc-0:9.0.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:valkey-rdma-0:9.0.6-0.1.hum1@aarch64",
          "Red Hat Hardened Images:valkey-rdma-0:9.0.6-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56684"
        },
        {
          "category": "external",
          "summary": "RHBZ#2517907",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517907"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56684",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56684"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56684",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56684"
        },
        {
          "category": "external",
          "summary": "https://github.com/valkey-io/valkey/commit/7cd5bcb7575d750ec2de618db80da58680a10fe3",
          "url": "https://github.com/valkey-io/valkey/commit/7cd5bcb7575d750ec2de618db80da58680a10fe3"
        },
        {
          "category": "external",
          "summary": "https://github.com/valkey-io/valkey/pull/4234",
          "url": "https://github.com/valkey-io/valkey/pull/4234"
        },
        {
          "category": "external",
          "summary": "https://github.com/valkey-io/valkey/releases/tag/7.2.14",
          "url": "https://github.com/valkey-io/valkey/releases/tag/7.2.14"
        },
        {
          "category": "external",
          "summary": "https://github.com/valkey-io/valkey/releases/tag/8.0.10",
          "url": "https://github.com/valkey-io/valkey/releases/tag/8.0.10"
        },
        {
          "category": "external",
          "summary": "https://github.com/valkey-io/valkey/releases/tag/8.1.9",
          "url": "https://github.com/valkey-io/valkey/releases/tag/8.1.9"
        },
        {
          "category": "external",
          "summary": "https://github.com/valkey-io/valkey/releases/tag/9.0.5",
          "url": "https://github.com/valkey-io/valkey/releases/tag/9.0.5"
        },
        {
          "category": "external",
          "summary": "https://github.com/valkey-io/valkey/releases/tag/9.1.1",
          "url": "https://github.com/valkey-io/valkey/releases/tag/9.1.1"
        },
        {
          "category": "external",
          "summary": "https://github.com/valkey-io/valkey/security/advisories/GHSA-53mc-f3m3-99vh",
          "url": "https://github.com/valkey-io/valkey/security/advisories/GHSA-53mc-f3m3-99vh"
        }
      ],
      "release_date": "2026-08-18T14:19:51.047000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-01T05:42:50+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:valkey-0:9.0.6-0.1.hum1@aarch64",
            "Red Hat Hardened Images:valkey-0:9.0.6-0.1.hum1@src",
            "Red Hat Hardened Images:valkey-0:9.0.6-0.1.hum1@x86_64",
            "Red Hat Hardened Images:valkey-compat-redis-0:9.0.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:valkey-compat-redis-0:9.0.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:valkey-compat-redis-devel-0:9.0.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:valkey-compat-redis-devel-0:9.0.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:valkey-devel-0:9.0.6-0.1.hum1@aarch64",
            "Red Hat Hardened Images:valkey-devel-0:9.0.6-0.1.hum1@x86_64",
            "Red Hat Hardened Images:valkey-doc-0:9.0.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:valkey-doc-0:9.0.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:valkey-rdma-0:9.0.6-0.1.hum1@aarch64",
            "Red Hat Hardened Images:valkey-rdma-0:9.0.6-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:61884"
        },
        {
          "category": "workaround",
          "details": "Restrict network access to the Valkey instance to trusted clients and networks by configuring firewall rules to limit inbound connections to the Valkey service port. Ensure only authorized and authenticated clients can connect. If TLS is not strictly required, consider disabling it. These network restrictions will persist if the Valkey service is reloaded or restarted.",
          "product_ids": [
            "Red Hat Hardened Images:valkey-0:9.0.6-0.1.hum1@aarch64",
            "Red Hat Hardened Images:valkey-0:9.0.6-0.1.hum1@src",
            "Red Hat Hardened Images:valkey-0:9.0.6-0.1.hum1@x86_64",
            "Red Hat Hardened Images:valkey-compat-redis-0:9.0.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:valkey-compat-redis-0:9.0.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:valkey-compat-redis-devel-0:9.0.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:valkey-compat-redis-devel-0:9.0.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:valkey-devel-0:9.0.6-0.1.hum1@aarch64",
            "Red Hat Hardened Images:valkey-devel-0:9.0.6-0.1.hum1@x86_64",
            "Red Hat Hardened Images:valkey-doc-0:9.0.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:valkey-doc-0:9.0.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:valkey-rdma-0:9.0.6-0.1.hum1@aarch64",
            "Red Hat Hardened Images:valkey-rdma-0:9.0.6-0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:valkey-0:9.0.6-0.1.hum1@aarch64",
            "Red Hat Hardened Images:valkey-0:9.0.6-0.1.hum1@src",
            "Red Hat Hardened Images:valkey-0:9.0.6-0.1.hum1@x86_64",
            "Red Hat Hardened Images:valkey-compat-redis-0:9.0.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:valkey-compat-redis-0:9.0.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:valkey-compat-redis-devel-0:9.0.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:valkey-compat-redis-devel-0:9.0.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:valkey-devel-0:9.0.6-0.1.hum1@aarch64",
            "Red Hat Hardened Images:valkey-devel-0:9.0.6-0.1.hum1@x86_64",
            "Red Hat Hardened Images:valkey-doc-0:9.0.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:valkey-doc-0:9.0.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:valkey-rdma-0:9.0.6-0.1.hum1@aarch64",
            "Red Hat Hardened Images:valkey-rdma-0:9.0.6-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "valkey: Valkey: Remote code execution via TLS pending-data processing use-after-free"
    },
    {
      "cve": "CVE-2026-63639",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-08-18T14:31:14.626618+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2517906"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Valkey, a distributed key-value database. A remote attacker could exploit a use-after-free vulnerability in the RESTORE command. This occurs when a malformed data stream is processed during stream deserialization, causing a shared resource to be improperly managed. If successfully exploited, this flaw could lead to remote code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "valkey: Valkey: Remote code execution via use-after-free in stream deserialization",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:valkey-0:9.0.6-0.1.hum1@aarch64",
          "Red Hat Hardened Images:valkey-0:9.0.6-0.1.hum1@src",
          "Red Hat Hardened Images:valkey-0:9.0.6-0.1.hum1@x86_64",
          "Red Hat Hardened Images:valkey-compat-redis-0:9.0.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:valkey-compat-redis-0:9.0.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:valkey-compat-redis-devel-0:9.0.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:valkey-compat-redis-devel-0:9.0.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:valkey-devel-0:9.0.6-0.1.hum1@aarch64",
          "Red Hat Hardened Images:valkey-devel-0:9.0.6-0.1.hum1@x86_64",
          "Red Hat Hardened Images:valkey-doc-0:9.0.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:valkey-doc-0:9.0.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:valkey-rdma-0:9.0.6-0.1.hum1@aarch64",
          "Red Hat Hardened Images:valkey-rdma-0:9.0.6-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-63639"
        },
        {
          "category": "external",
          "summary": "RHBZ#2517906",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517906"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-63639",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-63639"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-63639",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63639"
        },
        {
          "category": "external",
          "summary": "https://github.com/valkey-io/valkey/commit/06bc7768fe609f2054e69ccedefe7628f5675da9",
          "url": "https://github.com/valkey-io/valkey/commit/06bc7768fe609f2054e69ccedefe7628f5675da9"
        },
        {
          "category": "external",
          "summary": "https://github.com/valkey-io/valkey/commit/509cb3c74e8cbc9c0498ebe8b6c93dcd605e7271",
          "url": "https://github.com/valkey-io/valkey/commit/509cb3c74e8cbc9c0498ebe8b6c93dcd605e7271"
        },
        {
          "category": "external",
          "summary": "https://github.com/valkey-io/valkey/commit/98465eaffe3f95524a5046318bfbc4bdb9798291",
          "url": "https://github.com/valkey-io/valkey/commit/98465eaffe3f95524a5046318bfbc4bdb9798291"
        },
        {
          "category": "external",
          "summary": "https://github.com/valkey-io/valkey/commit/e95911d4d65be8789fa3705f44d7ed1e65378445",
          "url": "https://github.com/valkey-io/valkey/commit/e95911d4d65be8789fa3705f44d7ed1e65378445"
        },
        {
          "category": "external",
          "summary": "https://github.com/valkey-io/valkey/commit/f8d2027e8d4df790ac04974bf606408c8ea62778",
          "url": "https://github.com/valkey-io/valkey/commit/f8d2027e8d4df790ac04974bf606408c8ea62778"
        },
        {
          "category": "external",
          "summary": "https://github.com/valkey-io/valkey/pull/4073",
          "url": "https://github.com/valkey-io/valkey/pull/4073"
        },
        {
          "category": "external",
          "summary": "https://github.com/valkey-io/valkey/releases/tag/7.2.14",
          "url": "https://github.com/valkey-io/valkey/releases/tag/7.2.14"
        },
        {
          "category": "external",
          "summary": "https://github.com/valkey-io/valkey/releases/tag/8.0.10",
          "url": "https://github.com/valkey-io/valkey/releases/tag/8.0.10"
        },
        {
          "category": "external",
          "summary": "https://github.com/valkey-io/valkey/releases/tag/8.1.9",
          "url": "https://github.com/valkey-io/valkey/releases/tag/8.1.9"
        },
        {
          "category": "external",
          "summary": "https://github.com/valkey-io/valkey/releases/tag/9.0.5",
          "url": "https://github.com/valkey-io/valkey/releases/tag/9.0.5"
        },
        {
          "category": "external",
          "summary": "https://github.com/valkey-io/valkey/releases/tag/9.1.1",
          "url": "https://github.com/valkey-io/valkey/releases/tag/9.1.1"
        },
        {
          "category": "external",
          "summary": "https://github.com/valkey-io/valkey/security/advisories/GHSA-mvcj-73cw-22m4",
          "url": "https://github.com/valkey-io/valkey/security/advisories/GHSA-mvcj-73cw-22m4"
        }
      ],
      "release_date": "2026-08-18T14:23:52.508000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-01T05:42:50+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:valkey-0:9.0.6-0.1.hum1@aarch64",
            "Red Hat Hardened Images:valkey-0:9.0.6-0.1.hum1@src",
            "Red Hat Hardened Images:valkey-0:9.0.6-0.1.hum1@x86_64",
            "Red Hat Hardened Images:valkey-compat-redis-0:9.0.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:valkey-compat-redis-0:9.0.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:valkey-compat-redis-devel-0:9.0.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:valkey-compat-redis-devel-0:9.0.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:valkey-devel-0:9.0.6-0.1.hum1@aarch64",
            "Red Hat Hardened Images:valkey-devel-0:9.0.6-0.1.hum1@x86_64",
            "Red Hat Hardened Images:valkey-doc-0:9.0.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:valkey-doc-0:9.0.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:valkey-rdma-0:9.0.6-0.1.hum1@aarch64",
            "Red Hat Hardened Images:valkey-rdma-0:9.0.6-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:61884"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, restrict network access to the Valkey instance to only trusted clients and networks. This limits an attacker\u0027s ability to send malformed RDB stream payloads to the RESTORE command. Implement firewall rules to block unauthorized access to the Valkey port.",
          "product_ids": [
            "Red Hat Hardened Images:valkey-0:9.0.6-0.1.hum1@aarch64",
            "Red Hat Hardened Images:valkey-0:9.0.6-0.1.hum1@src",
            "Red Hat Hardened Images:valkey-0:9.0.6-0.1.hum1@x86_64",
            "Red Hat Hardened Images:valkey-compat-redis-0:9.0.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:valkey-compat-redis-0:9.0.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:valkey-compat-redis-devel-0:9.0.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:valkey-compat-redis-devel-0:9.0.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:valkey-devel-0:9.0.6-0.1.hum1@aarch64",
            "Red Hat Hardened Images:valkey-devel-0:9.0.6-0.1.hum1@x86_64",
            "Red Hat Hardened Images:valkey-doc-0:9.0.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:valkey-doc-0:9.0.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:valkey-rdma-0:9.0.6-0.1.hum1@aarch64",
            "Red Hat Hardened Images:valkey-rdma-0:9.0.6-0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:valkey-0:9.0.6-0.1.hum1@aarch64",
            "Red Hat Hardened Images:valkey-0:9.0.6-0.1.hum1@src",
            "Red Hat Hardened Images:valkey-0:9.0.6-0.1.hum1@x86_64",
            "Red Hat Hardened Images:valkey-compat-redis-0:9.0.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:valkey-compat-redis-0:9.0.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:valkey-compat-redis-devel-0:9.0.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:valkey-compat-redis-devel-0:9.0.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:valkey-devel-0:9.0.6-0.1.hum1@aarch64",
            "Red Hat Hardened Images:valkey-devel-0:9.0.6-0.1.hum1@x86_64",
            "Red Hat Hardened Images:valkey-doc-0:9.0.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:valkey-doc-0:9.0.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:valkey-rdma-0:9.0.6-0.1.hum1@aarch64",
            "Red Hat Hardened Images:valkey-rdma-0:9.0.6-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "valkey: Valkey: Remote code execution via use-after-free in stream deserialization"
    },
    {
      "cve": "CVE-2026-82631",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-08-31T08:00:58.316077+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2526157"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Valkey. A use-after-free vulnerability exists within the `handleClientsBlockedOnKey` function of the Blocked-on-keys Subsystem. A remote attacker could exploit this flaw, leading to a denial of service. The complexity of exploiting this vulnerability is high.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "valkey: Valkey: Use-after-free vulnerability in Blocked-on-keys subsystem",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:valkey-0:9.0.6-0.1.hum1@aarch64",
          "Red Hat Hardened Images:valkey-0:9.0.6-0.1.hum1@src",
          "Red Hat Hardened Images:valkey-0:9.0.6-0.1.hum1@x86_64",
          "Red Hat Hardened Images:valkey-compat-redis-0:9.0.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:valkey-compat-redis-0:9.0.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:valkey-compat-redis-devel-0:9.0.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:valkey-compat-redis-devel-0:9.0.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:valkey-devel-0:9.0.6-0.1.hum1@aarch64",
          "Red Hat Hardened Images:valkey-devel-0:9.0.6-0.1.hum1@x86_64",
          "Red Hat Hardened Images:valkey-doc-0:9.0.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:valkey-doc-0:9.0.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:valkey-rdma-0:9.0.6-0.1.hum1@aarch64",
          "Red Hat Hardened Images:valkey-rdma-0:9.0.6-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-82631"
        },
        {
          "category": "external",
          "summary": "RHBZ#2526157",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2526157"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-82631",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-82631"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-82631",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82631"
        },
        {
          "category": "external",
          "summary": "https://github.com/user-attachments/files/30111628/PoC.zip",
          "url": "https://github.com/user-attachments/files/30111628/PoC.zip"
        },
        {
          "category": "external",
          "summary": "https://github.com/valkey-io/valkey/",
          "url": "https://github.com/valkey-io/valkey/"
        },
        {
          "category": "external",
          "summary": "https://github.com/valkey-io/valkey/commit/b2fb0e13f5b4c8c2fb63dcfc2c37a067a0d6d20b",
          "url": "https://github.com/valkey-io/valkey/commit/b2fb0e13f5b4c8c2fb63dcfc2c37a067a0d6d20b"
        },
        {
          "category": "external",
          "summary": "https://github.com/valkey-io/valkey/issues/4198",
          "url": "https://github.com/valkey-io/valkey/issues/4198"
        },
        {
          "category": "external",
          "summary": "https://github.com/valkey-io/valkey/pull/4212",
          "url": "https://github.com/valkey-io/valkey/pull/4212"
        },
        {
          "category": "external",
          "summary": "https://vuldb.com/cve/CVE-2026-82631",
          "url": "https://vuldb.com/cve/CVE-2026-82631"
        },
        {
          "category": "external",
          "summary": "https://vuldb.com/submit/893793",
          "url": "https://vuldb.com/submit/893793"
        },
        {
          "category": "external",
          "summary": "https://vuldb.com/vuln/397129",
          "url": "https://vuldb.com/vuln/397129"
        },
        {
          "category": "external",
          "summary": "https://vuldb.com/vuln/397129/cti",
          "url": "https://vuldb.com/vuln/397129/cti"
        }
      ],
      "release_date": "2026-08-31T07:45:13.359000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-01T05:42:50+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:valkey-0:9.0.6-0.1.hum1@aarch64",
            "Red Hat Hardened Images:valkey-0:9.0.6-0.1.hum1@src",
            "Red Hat Hardened Images:valkey-0:9.0.6-0.1.hum1@x86_64",
            "Red Hat Hardened Images:valkey-compat-redis-0:9.0.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:valkey-compat-redis-0:9.0.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:valkey-compat-redis-devel-0:9.0.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:valkey-compat-redis-devel-0:9.0.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:valkey-devel-0:9.0.6-0.1.hum1@aarch64",
            "Red Hat Hardened Images:valkey-devel-0:9.0.6-0.1.hum1@x86_64",
            "Red Hat Hardened Images:valkey-doc-0:9.0.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:valkey-doc-0:9.0.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:valkey-rdma-0:9.0.6-0.1.hum1@aarch64",
            "Red Hat Hardened Images:valkey-rdma-0:9.0.6-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:61884"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "valkey: Valkey: Use-after-free vulnerability in Blocked-on-keys subsystem"
    },
    {
      "cve": "CVE-2026-82677",
      "cwe": {
        "id": "CWE-1341",
        "name": "Multiple Releases of Same Resource or Handle"
      },
      "discovery_date": "2026-08-31T10:21:05.190331+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2526233"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in valkey-io valkey. A remote attacker could exploit a double free vulnerability in the `moduleTimerHandler` function within the Module Timer subsystem (src/module.c). This flaw could lead to a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "valkey: Valkey: Denial of Service via double free in Module Timer subsystem",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A double-free vulnerability in the Module Timer subsystem (moduleTimerHandler in src/module.c) of Valkey allows remote, highly privileged authenticated attackers to trigger a denial of service (daemon crash) by manipulating module timers. Execution remains confined within the process runtime environment, mitigated by default SELinux policies and container isolation preventing host-level escalation.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:valkey-0:9.0.6-0.1.hum1@aarch64",
          "Red Hat Hardened Images:valkey-0:9.0.6-0.1.hum1@src",
          "Red Hat Hardened Images:valkey-0:9.0.6-0.1.hum1@x86_64",
          "Red Hat Hardened Images:valkey-compat-redis-0:9.0.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:valkey-compat-redis-0:9.0.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:valkey-compat-redis-devel-0:9.0.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:valkey-compat-redis-devel-0:9.0.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:valkey-devel-0:9.0.6-0.1.hum1@aarch64",
          "Red Hat Hardened Images:valkey-devel-0:9.0.6-0.1.hum1@x86_64",
          "Red Hat Hardened Images:valkey-doc-0:9.0.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:valkey-doc-0:9.0.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:valkey-rdma-0:9.0.6-0.1.hum1@aarch64",
          "Red Hat Hardened Images:valkey-rdma-0:9.0.6-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-82677"
        },
        {
          "category": "external",
          "summary": "RHBZ#2526233",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2526233"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-82677",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-82677"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-82677",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82677"
        },
        {
          "category": "external",
          "summary": "https://github.com/user-attachments/files/30118801/PoC.zip",
          "url": "https://github.com/user-attachments/files/30118801/PoC.zip"
        },
        {
          "category": "external",
          "summary": "https://github.com/valkey-io/valkey/",
          "url": "https://github.com/valkey-io/valkey/"
        },
        {
          "category": "external",
          "summary": "https://github.com/valkey-io/valkey/commit/b349fe2821e3998534b1454c1b64a478daf8c6b7",
          "url": "https://github.com/valkey-io/valkey/commit/b349fe2821e3998534b1454c1b64a478daf8c6b7"
        },
        {
          "category": "external",
          "summary": "https://github.com/valkey-io/valkey/issues/4200",
          "url": "https://github.com/valkey-io/valkey/issues/4200"
        },
        {
          "category": "external",
          "summary": "https://github.com/valkey-io/valkey/pull/4211",
          "url": "https://github.com/valkey-io/valkey/pull/4211"
        },
        {
          "category": "external",
          "summary": "https://vuldb.com/cve/CVE-2026-82677",
          "url": "https://vuldb.com/cve/CVE-2026-82677"
        },
        {
          "category": "external",
          "summary": "https://vuldb.com/submit/893959",
          "url": "https://vuldb.com/submit/893959"
        },
        {
          "category": "external",
          "summary": "https://vuldb.com/vuln/397172",
          "url": "https://vuldb.com/vuln/397172"
        },
        {
          "category": "external",
          "summary": "https://vuldb.com/vuln/397172/cti",
          "url": "https://vuldb.com/vuln/397172/cti"
        }
      ],
      "release_date": "2026-08-31T10:00:15.053000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-01T05:42:50+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:valkey-0:9.0.6-0.1.hum1@aarch64",
            "Red Hat Hardened Images:valkey-0:9.0.6-0.1.hum1@src",
            "Red Hat Hardened Images:valkey-0:9.0.6-0.1.hum1@x86_64",
            "Red Hat Hardened Images:valkey-compat-redis-0:9.0.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:valkey-compat-redis-0:9.0.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:valkey-compat-redis-devel-0:9.0.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:valkey-compat-redis-devel-0:9.0.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:valkey-devel-0:9.0.6-0.1.hum1@aarch64",
            "Red Hat Hardened Images:valkey-devel-0:9.0.6-0.1.hum1@x86_64",
            "Red Hat Hardened Images:valkey-doc-0:9.0.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:valkey-doc-0:9.0.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:valkey-rdma-0:9.0.6-0.1.hum1@aarch64",
            "Red Hat Hardened Images:valkey-rdma-0:9.0.6-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:61884"
        },
        {
          "category": "workaround",
          "details": "Restrict access to high-privilege administrative users capable of executing module timer operations, or isolate the Valkey service using network firewalls and RBAC controls until fixed packages are installed.",
          "product_ids": [
            "Red Hat Hardened Images:valkey-0:9.0.6-0.1.hum1@aarch64",
            "Red Hat Hardened Images:valkey-0:9.0.6-0.1.hum1@src",
            "Red Hat Hardened Images:valkey-0:9.0.6-0.1.hum1@x86_64",
            "Red Hat Hardened Images:valkey-compat-redis-0:9.0.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:valkey-compat-redis-0:9.0.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:valkey-compat-redis-devel-0:9.0.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:valkey-compat-redis-devel-0:9.0.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:valkey-devel-0:9.0.6-0.1.hum1@aarch64",
            "Red Hat Hardened Images:valkey-devel-0:9.0.6-0.1.hum1@x86_64",
            "Red Hat Hardened Images:valkey-doc-0:9.0.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:valkey-doc-0:9.0.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:valkey-rdma-0:9.0.6-0.1.hum1@aarch64",
            "Red Hat Hardened Images:valkey-rdma-0:9.0.6-0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:valkey-0:9.0.6-0.1.hum1@aarch64",
            "Red Hat Hardened Images:valkey-0:9.0.6-0.1.hum1@src",
            "Red Hat Hardened Images:valkey-0:9.0.6-0.1.hum1@x86_64",
            "Red Hat Hardened Images:valkey-compat-redis-0:9.0.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:valkey-compat-redis-0:9.0.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:valkey-compat-redis-devel-0:9.0.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:valkey-compat-redis-devel-0:9.0.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:valkey-devel-0:9.0.6-0.1.hum1@aarch64",
            "Red Hat Hardened Images:valkey-devel-0:9.0.6-0.1.hum1@x86_64",
            "Red Hat Hardened Images:valkey-doc-0:9.0.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:valkey-doc-0:9.0.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:valkey-rdma-0:9.0.6-0.1.hum1@aarch64",
            "Red Hat Hardened Images:valkey-rdma-0:9.0.6-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "valkey: Valkey: Denial of Service via double free in Module Timer subsystem"
    }
  ]
}

CVE-2026-56684 (GCVE-0-2026-56684)

Vulnerability from cvelistv5 – Published: 2026-08-18 14:19 – Updated: 2026-08-19 03:56

Title

Valkey: TLS pending-data processing use-after-free may allow remote code execution

Summary

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's tlsProcessPendingData function iterates pending_list while an authenticated client can trigger CLIENT KILL, causing connTLSClose to delete the iterator's cached next node and producing a use-after-free that can crash the server or potentially allow remote code execution when TLS is enabled. This issue is fixed in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-18 00:00 UTC

CWE

CWE-416 - Use After Free

Assigner

GitHub_M mitre root Scorecard

References

8 references

URL	Tags
https://github.com/valkey-io/valkey/security/advi…	x_refsource_CONFIRM
https://github.com/valkey-io/valkey/pull/4234	x_refsource_MISC
https://github.com/valkey-io/valkey/commit/7cd5bc…	x_refsource_MISC
https://github.com/valkey-io/valkey/releases/tag/7.2.14	x_refsource_MISC
https://github.com/valkey-io/valkey/releases/tag/8.0.10	x_refsource_MISC
https://github.com/valkey-io/valkey/releases/tag/8.1.9	x_refsource_MISC
https://github.com/valkey-io/valkey/releases/tag/9.0.5	x_refsource_MISC
https://github.com/valkey-io/valkey/releases/tag/9.1.1	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
valkey-io	valkey	Affected: < 7.2.14 Affected: >= 8.0.0, < 8.0.10 Affected: >= 8.1.0, < 8.1.9 Affected: >= 9.0.0, < 9.0.5 Affected: >= 9.1.0, < 9.1.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-56684",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-18T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-19T03:56:13.565Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "valkey",
          "vendor": "valkey-io",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 7.2.14"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0.0, \u003c 8.0.10"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.1.0, \u003c 8.1.9"
            },
            {
              "status": "affected",
              "version": "\u003e= 9.0.0, \u003c 9.0.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 9.1.0, \u003c 9.1.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey\u0027s tlsProcessPendingData function iterates pending_list while an authenticated client can trigger CLIENT KILL, causing connTLSClose to delete the iterator\u0027s cached next node and producing a use-after-free that can crash the server or potentially allow remote code execution when TLS is enabled. This issue is fixed in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "CWE-416: Use After Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-18T14:19:51.047Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/valkey-io/valkey/security/advisories/GHSA-53mc-f3m3-99vh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/valkey-io/valkey/security/advisories/GHSA-53mc-f3m3-99vh"
        },
        {
          "name": "https://github.com/valkey-io/valkey/pull/4234",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/valkey-io/valkey/pull/4234"
        },
        {
          "name": "https://github.com/valkey-io/valkey/commit/7cd5bcb7575d750ec2de618db80da58680a10fe3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/valkey-io/valkey/commit/7cd5bcb7575d750ec2de618db80da58680a10fe3"
        },
        {
          "name": "https://github.com/valkey-io/valkey/releases/tag/7.2.14",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/valkey-io/valkey/releases/tag/7.2.14"
        },
        {
          "name": "https://github.com/valkey-io/valkey/releases/tag/8.0.10",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/valkey-io/valkey/releases/tag/8.0.10"
        },
        {
          "name": "https://github.com/valkey-io/valkey/releases/tag/8.1.9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/valkey-io/valkey/releases/tag/8.1.9"
        },
        {
          "name": "https://github.com/valkey-io/valkey/releases/tag/9.0.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/valkey-io/valkey/releases/tag/9.0.5"
        },
        {
          "name": "https://github.com/valkey-io/valkey/releases/tag/9.1.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/valkey-io/valkey/releases/tag/9.1.1"
        }
      ],
      "source": {
        "advisory": "GHSA-53mc-f3m3-99vh",
        "discovery": "UNKNOWN"
      },
      "title": "Valkey: TLS pending-data processing use-after-free may allow remote code execution"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-56684",
    "datePublished": "2026-08-18T14:19:51.047Z",
    "dateReserved": "2026-06-22T16:39:01.044Z",
    "dateUpdated": "2026-08-19T03:56:13.565Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-63639 (GCVE-0-2026-63639)

Vulnerability from cvelistv5 – Published: 2026-08-18 14:23 – Updated: 2026-08-20 18:36

Title

Valkey: UAF in stream deserialization may lead to remote code execution

Summary

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when one consumer is deleted while another still references the shared NACK and potentially allowing remote code execution. This issue is fixed in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-19 03:56 UTC

CWE

CWE-416 - Use After Free

Assigner

GitHub_M mitre root Scorecard

References

12 references

URL	Tags
https://github.com/valkey-io/valkey/security/advi…	x_refsource_CONFIRM
https://github.com/valkey-io/valkey/pull/4073	x_refsource_MISC
https://github.com/valkey-io/valkey/commit/06bc77…	x_refsource_MISC
https://github.com/valkey-io/valkey/commit/509cb3…	x_refsource_MISC
https://github.com/valkey-io/valkey/commit/98465e…	x_refsource_MISC
https://github.com/valkey-io/valkey/commit/e95911…	x_refsource_MISC
https://github.com/valkey-io/valkey/commit/f8d202…	x_refsource_MISC
https://github.com/valkey-io/valkey/releases/tag/7.2.14	x_refsource_MISC
https://github.com/valkey-io/valkey/releases/tag/8.0.10	x_refsource_MISC
https://github.com/valkey-io/valkey/releases/tag/8.1.9	x_refsource_MISC
https://github.com/valkey-io/valkey/releases/tag/9.0.5	x_refsource_MISC
https://github.com/valkey-io/valkey/releases/tag/9.1.1	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
valkey-io	valkey	Affected: < 7.2.14 Affected: >= 8.0.0, < 8.0.10 Affected: >= 8.1.0, < 8.1.9 Affected: >= 9.0.0, < 9.0.5 Affected: >= 9.1.0, < 9.1.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63639",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-19T03:56:16.213417Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-20T18:36:40.745Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "valkey",
          "vendor": "valkey-io",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 7.2.14"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0.0, \u003c 8.0.10"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.1.0, \u003c 8.1.9"
            },
            {
              "status": "affected",
              "version": "\u003e= 9.0.0, \u003c 9.0.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 9.1.0, \u003c 9.1.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey\u0027s RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when one consumer is deleted while another still references the shared NACK and potentially allowing remote code execution. This issue is fixed in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "CWE-416: Use After Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-18T14:23:52.508Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/valkey-io/valkey/security/advisories/GHSA-mvcj-73cw-22m4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/valkey-io/valkey/security/advisories/GHSA-mvcj-73cw-22m4"
        },
        {
          "name": "https://github.com/valkey-io/valkey/pull/4073",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/valkey-io/valkey/pull/4073"
        },
        {
          "name": "https://github.com/valkey-io/valkey/commit/06bc7768fe609f2054e69ccedefe7628f5675da9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/valkey-io/valkey/commit/06bc7768fe609f2054e69ccedefe7628f5675da9"
        },
        {
          "name": "https://github.com/valkey-io/valkey/commit/509cb3c74e8cbc9c0498ebe8b6c93dcd605e7271",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/valkey-io/valkey/commit/509cb3c74e8cbc9c0498ebe8b6c93dcd605e7271"
        },
        {
          "name": "https://github.com/valkey-io/valkey/commit/98465eaffe3f95524a5046318bfbc4bdb9798291",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/valkey-io/valkey/commit/98465eaffe3f95524a5046318bfbc4bdb9798291"
        },
        {
          "name": "https://github.com/valkey-io/valkey/commit/e95911d4d65be8789fa3705f44d7ed1e65378445",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/valkey-io/valkey/commit/e95911d4d65be8789fa3705f44d7ed1e65378445"
        },
        {
          "name": "https://github.com/valkey-io/valkey/commit/f8d2027e8d4df790ac04974bf606408c8ea62778",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/valkey-io/valkey/commit/f8d2027e8d4df790ac04974bf606408c8ea62778"
        },
        {
          "name": "https://github.com/valkey-io/valkey/releases/tag/7.2.14",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/valkey-io/valkey/releases/tag/7.2.14"
        },
        {
          "name": "https://github.com/valkey-io/valkey/releases/tag/8.0.10",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/valkey-io/valkey/releases/tag/8.0.10"
        },
        {
          "name": "https://github.com/valkey-io/valkey/releases/tag/8.1.9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/valkey-io/valkey/releases/tag/8.1.9"
        },
        {
          "name": "https://github.com/valkey-io/valkey/releases/tag/9.0.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/valkey-io/valkey/releases/tag/9.0.5"
        },
        {
          "name": "https://github.com/valkey-io/valkey/releases/tag/9.1.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/valkey-io/valkey/releases/tag/9.1.1"
        }
      ],
      "source": {
        "advisory": "GHSA-mvcj-73cw-22m4",
        "discovery": "UNKNOWN"
      },
      "title": "Valkey: UAF in stream deserialization may lead to remote code execution"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63639",
    "datePublished": "2026-08-18T14:23:52.508Z",
    "dateReserved": "2026-07-17T14:11:15.482Z",
    "dateUpdated": "2026-08-20T18:36:40.745Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-82631 (GCVE-0-2026-82631)

Vulnerability from cvelistv5 – Published: 2026-08-31 07:45 – Updated: 2026-08-31 11:33 X_Open Source

Title

valkey-io valkey Blocked-on-keys blocked.c handleClientsBlockedOnKey use after free

Summary

A security flaw has been discovered in valkey-io valkey 9.1.0. The affected element is the function handleClientsBlockedOnKey of the file src/blocked.c of the component Blocked-on-keys Subsystem. The manipulation results in use after free. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is described as difficult. The exploit has been released to the public and may be used for attacks. The patch is identified as b2fb0e13f5b4c8c2fb63dcfc2c37a067a0d6d20b. Applying a patch is advised to resolve this issue.

Severity

2.1 (Low)


                        
                          CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

2.2 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C

2.2 (Low)


                        
                          CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-31 11:22 UTC

CWE

CWE-416 - Use After Free
CWE-119 - Memory Corruption

Assigner

VulDB mitre root Scorecard

References

9 references

URL	Tags
https://vuldb.com/vuln/397129	vdb-entrytechnical-description
https://vuldb.com/vuln/397129/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-82631	third-party-advisory
https://vuldb.com/submit/893793	third-party-advisory
https://github.com/valkey-io/valkey/issues/4198	issue-tracking
https://github.com/valkey-io/valkey/pull/4212	issue-trackingpatch
https://github.com/user-attachments/files/3011162…	exploit
https://github.com/valkey-io/valkey/commit/b2fb0e…	patch
https://github.com/valkey-io/valkey/	product

Impacted products

1 product

Vendor	Product	Version
valkey-io	valkey	Affected: 9.1.0 cpe:2.3:a:valkey-io:valkey::::::::

Credits

VULL (VulDB User)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-82631",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-31T11:22:07.646542Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-31T11:33:30.966Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:valkey-io:valkey:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Blocked-on-keys Subsystem"
          ],
          "product": "valkey",
          "vendor": "valkey-io",
          "versions": [
            {
              "status": "affected",
              "version": "9.1.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "VULL (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A security flaw has been discovered in valkey-io valkey 9.1.0. The affected element is the function handleClientsBlockedOnKey of the file src/blocked.c of the component Blocked-on-keys Subsystem. The manipulation results in use after free. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is described as difficult. The exploit has been released to the public and may be used for attacks. The patch is identified as b2fb0e13f5b4c8c2fb63dcfc2c37a067a0d6d20b. Applying a patch is advised to resolve this issue."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 2.1,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 2.2,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 2.2,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 1.7,
            "vectorString": "AV:N/AC:H/Au:M/C:N/I:N/A:P/E:POC/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "Use After Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-119",
              "description": "Memory Corruption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-31T07:45:13.359Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-397129 | valkey-io valkey Blocked-on-keys blocked.c handleClientsBlockedOnKey use after free",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/397129"
        },
        {
          "name": "VDB-397129 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/397129/cti"
        },
        {
          "name": "CVE-2026-82631 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-82631"
        },
        {
          "name": "Submit #893793 | Valkey Project Valkey 9.1.0 Heap Use After Free",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/893793"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/valkey-io/valkey/issues/4198"
        },
        {
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/valkey-io/valkey/pull/4212"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/user-attachments/files/30111628/PoC.zip"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/valkey-io/valkey/commit/b2fb0e13f5b4c8c2fb63dcfc2c37a067a0d6d20b"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/valkey-io/valkey/"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-30T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-08-30T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-08-30T12:15:38.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "valkey-io valkey Blocked-on-keys blocked.c handleClientsBlockedOnKey use after free",
      "x_generator": [
        "VulDB PVTS v202608"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-82631",
    "datePublished": "2026-08-31T07:45:13.359Z",
    "dateReserved": "2026-08-30T10:10:33.072Z",
    "dateUpdated": "2026-08-31T11:33:30.966Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-82677 (GCVE-0-2026-82677)

Vulnerability from cvelistv5 – Published: 2026-08-31 10:00 – Updated: 2026-08-31 15:09 X_Open Source

Title

valkey-io valkey Module Timer module.c moduleTimerHandler double free

Summary

A vulnerability was determined in valkey-io valkey 9.1.0. Impacted is the function moduleTimerHandler of the file src/module.c of the component Module Timer Subsystem. This manipulation causes double free. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Patch name: b349fe2821e3998534b1454c1b64a478daf8c6b7. To fix this issue, it is recommended to deploy a patch.

Severity

4.8 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

2.4 (Low)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C

2.4 (Low)


                        
                          CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-31 15:08 UTC

CWE

CWE-415 - Double Free
CWE-119 - Memory Corruption

Assigner

VulDB mitre root Scorecard

References

9 references

URL	Tags
https://vuldb.com/vuln/397172	vdb-entrytechnical-description
https://vuldb.com/vuln/397172/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-82677	third-party-advisory
https://vuldb.com/submit/893959	third-party-advisory
https://github.com/valkey-io/valkey/issues/4200	issue-tracking
https://github.com/valkey-io/valkey/pull/4211	issue-trackingpatch
https://github.com/user-attachments/files/3011880…	exploit
https://github.com/valkey-io/valkey/commit/b349fe…	patch
https://github.com/valkey-io/valkey/	product

Impacted products

1 product

Vendor	Product	Version
valkey-io	valkey	Affected: 9.1.0 cpe:2.3:a:valkey-io:valkey::::::::

Credits

VULL (VulDB User)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-82677",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-31T15:08:56.209775Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-31T15:09:07.620Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://vuldb.com/submit/893959"
          },
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/valkey-io/valkey/issues/4200"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:valkey-io:valkey:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Module Timer Subsystem"
          ],
          "product": "valkey",
          "vendor": "valkey-io",
          "versions": [
            {
              "status": "affected",
              "version": "9.1.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "VULL (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was determined in valkey-io valkey 9.1.0. Impacted is the function moduleTimerHandler of the file src/module.c of the component Module Timer Subsystem. This manipulation causes double free. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Patch name: b349fe2821e3998534b1454c1b64a478daf8c6b7. To fix this issue, it is recommended to deploy a patch."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 2.4,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 2.4,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 3.3,
            "vectorString": "AV:N/AC:L/Au:M/C:N/I:N/A:P/E:POC/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-415",
              "description": "Double Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-119",
              "description": "Memory Corruption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-31T10:00:15.053Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-397172 | valkey-io valkey Module Timer module.c moduleTimerHandler double free",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/397172"
        },
        {
          "name": "VDB-397172 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/397172/cti"
        },
        {
          "name": "CVE-2026-82677 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-82677"
        },
        {
          "name": "Submit #893959 | Valkey Project Valkey 9.1.0 Double Free",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/893959"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/valkey-io/valkey/issues/4200"
        },
        {
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/valkey-io/valkey/pull/4211"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/user-attachments/files/30118801/PoC.zip"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/valkey-io/valkey/commit/b349fe2821e3998534b1454c1b64a478daf8c6b7"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/valkey-io/valkey/"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-30T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-08-30T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-08-30T18:41:14.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "valkey-io valkey Module Timer module.c moduleTimerHandler double free",
      "x_generator": [
        "VulDB PVTS v202608"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-82677",
    "datePublished": "2026-08-31T10:00:15.053Z",
    "dateReserved": "2026-08-30T16:36:08.965Z",
    "dateUpdated": "2026-08-31T15:09:07.620Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:61884

CVE-2026-56684 (GCVE-0-2026-56684)

CVE-2026-63639 (GCVE-0-2026-63639)

CVE-2026-82631 (GCVE-0-2026-82631)

CVE-2026-82677 (GCVE-0-2026-82677)

Tags

Sightings

Nomenclature

Related by attack behaviour