p PatchFirst

CVE-2026-56684

CVE-2026-56684 · Valkey: TLS pending-data processing use-after-free may allow remote code execution

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's tlsProcessPendingData function iterates pending_list while an authenticated client can trigger CLIENT KILL, causing connTLSClose to delete the iterator's cached next node and producing a use-after-free that can crash the server or potentially allow remote code execution when TLS is enabled. This issue is fixed in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1.

CVSS 7.5 · High · EPSS 0.9% · Fix available

Published
Updated

Stack: system · database

Affected products and versions

  • valkey

    Versions
    • < 7.2.14: Affected
    • >= 8.0.0, < 8.0.10: Affected
    • >= 8.1.0, < 8.1.9: Affected
    • >= 9.0.0, < 9.0.5: Affected
    • >= 9.1.0, < 9.1.1: Affected

    No fix published

  • redict Debian:14

    Versions
    • 7.3.0+ds-1
    • 7.3.0+ds-2
    • 7.3.0+ds-3
    • 7.3.0+ds-3~bpo12+1
    • 7.3.1+ds-1
    • 7.3.2+ds-1
    • 7.3.2+ds-1~bpo12+1
    • 7.3.5+ds-1
    • 7.3.5+ds-1~bpo12+1
    • 7.3.6+ds-1
    • 7.3.6+ds-1~bpo12+1
    • 7.3.6+ds-1~bpo13+1
    • 7.3.6+ds-2
    • 7.3.6+ds-2~bpo12+1
    • 7.3.6+ds-2~bpo13+1
    • 7.3.6+ds-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • valkey Debian:13

    Versions
    • 8.1.1+dfsg1-3
    • 8.1.1+dfsg1-3+deb13u1
    • 8.1.1+dfsg1-3+deb13u2
    • 8.1.4+dfsg1-1
    • 8.1.4+dfsg1-2
    • 9.1.1-1
    • 9.1.2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • valkey Debian:14

    Versions
    • 8.1.1+dfsg1-3
    • 8.1.4+dfsg1-1
    • 8.1.4+dfsg1-2
    Affected ranges
    • ECOSYSTEM: < 9.1.1-1

    Update to 9.1.1-1

  • valkey Ubuntu:Pro:24.04:LTS

    Versions
    • 7.2.5+dfsg1-2ubuntu4~24.04.1
    • 7.2.7+dfsg1-0ubuntu0.24.04.1
    • 7.2.8+dfsg1-0ubuntu0.24.04.1
    • 7.2.8+dfsg1-0ubuntu0.24.04.2
    • 7.2.8+dfsg1-0ubuntu0.24.04.3
    • 7.2.10+dfsg1-0ubuntu0.1
    • 7.2.11+dfsg1-0ubuntu0.1
    • 7.2.11+dfsg1-0ubuntu0.2
    • 7.2.12+dfsg1-0ubuntu0.1
    • 7.2.13+dfsg1-0ubuntu0.1
    Affected ranges
    • ECOSYSTEM: < 7.2.13+dfsg1-0ubuntu0.1+esm1

    Update to 7.2.13+dfsg1-0ubuntu0.1+esm1

  • valkey Ubuntu:26.04:LTS

    Versions
    • 8.1.3+dfsg1-0ubuntu2
    • 8.1.4+dfsg1-0ubuntu1
    • 9.0.2-0ubuntu1
    • 9.0.3-0ubuntu1
    • 9.0.3-0ubuntu2
    • 9.0.4-0ubuntu0.1
    Affected ranges
    • ECOSYSTEM: < 9.0.4-0ubuntu0.2

    Update to 9.0.4-0ubuntu0.2

Original sources

Check your server →