High severity · published Aug 18, 2026
CVE-2026-56684
Valkey: TLS pending-data processing use-after-free may allow remote code execution
7.5
CVSS
0.9%
EPSS
No
On KEV
Description
Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's tlsProcessPendingData function iterates pending_list while an authenticated client can trigger CLIENT KILL, causing connTLSClose to delete the iterator's cached next node and producing a use-after-free that can crash the server or potentially allow remote code execution when TLS is enabled. This issue is fixed in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VA
valkey · valkey-io
< 7.2.14; >= 8.0.0, < 8.0.10; >= 8.1.0, < 8.1.9; >= 9.0.0, < 9.0.5; >= 9.1.0, < 9.1.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-56684
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-56684
github.com
https://github.com/valkey-io/valkey/commit/7cd5bcb7575d750ec2de618db80da58680a10fe3
github.com
https://github.com/valkey-io/valkey/pull/4234
github.com
https://github.com/valkey-io/valkey/releases/tag/7.2.14
github.com
https://github.com/valkey-io/valkey/releases/tag/8.0.10
github.com
https://github.com/valkey-io/valkey/releases/tag/8.1.9
github.com
https://github.com/valkey-io/valkey/releases/tag/9.0.5
More from valkey
8.8
CVE-2026-63639
Valkey: UAF in stream deserialization may lead to remote code execution
7.5
CVE-2026-27623
Valkey has Pre-Authentication DOS from malformed RESP request
7.5
CVE-2026-21863
Malformed Valkey Cluster bus message can lead to Remote DoS
7.1
CVE-2025-67733
Valkey Affected by RESP Protocol Injection via Lua error_reply
5.3
CVE-2026-85522
valkey-io valkey Slot Migration cluster_migrateslots.c createSlotImportJob out-of-bounds