CVE-2026-63639
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk65th percentile - higher than 65% of all known CVEs
Summary
Use-after-free vulnerability in Valkey prior to versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1. The RESTORE command accepts a malformed RDB stream that assigns one NACK to multiple consumers, potentially allowing remote code execution.
Risk Assessment
Risk of remote code execution or service crash, potentially leading to compromise of the database server.
Recommendation
Update Valkey to one of the fixed versions: 7.2.14, 8.0.10, 8.1.9, 9.0.5, or 9.1.1.
Original NVD description (English source)
Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when one consumer is deleted while another still references the shared NACK and potentially allowing remote code execution. This issue is fixed in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1.