Login Request a demo
VA
Product
valkey
by valkey-io · last CVE Sep 6, 2026
9
CVEs
0
On KEV
8.8
Max CVSS
0
New 30D
Vulnerabilities9In the news0Timeline
Severity mix
Critical 0High 5Medium 1Low 3
Severity
All severities9Critical0High5Medium1Low3
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add valkey to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-63639
8.8
1%
Aug 18
Valkey: UAF in stream deserialization may lead to remote code execution
Affected: < 7.2.14; >= 8.0.0, < 8.0.10; >= 8.1.0, < 8.1.9; >= 9.0.0, < 9.0.5; >= 9.1.0, < 9.1.1
CVE-2026-56684
7.5
1%
Aug 18
Valkey: TLS pending-data processing use-after-free may allow remote code execution
Affected: < 7.2.14; >= 8.0.0, < 8.0.10; >= 8.1.0, < 8.1.9; >= 9.0.0, < 9.0.5; >= 9.1.0, < 9.1.1
CVE-2026-27623
7.5
0%
Feb 23
Valkey has Pre-Authentication DOS from malformed RESP request
Affected: >= 9.0.0, < 9.0.3
CVE-2026-21863
7.5
1%
Feb 23
Malformed Valkey Cluster bus message can lead to Remote DoS
Affected: < 7.2.12; >= 8.0.0, < 8.0.7; >= 8.1.0, < 8.1.6; >= 9.0.0, < 9.0.2
CVE-2025-67733
7.1
1%
Feb 23
Valkey Affected by RESP Protocol Injection via Lua error_reply
Affected: < 7.2.12; >= 8.0.0, < 8.0.7; >= 8.1.0, < 8.1.6; >= 9.0.0, < 9.0.2
CVE-2026-85522
5.3
1%
Sep 4
valkey-io valkey Slot Migration cluster_migrateslots.c createSlotImportJob out-of-bounds
Affected: 9.0; 9.1.0; 9.5.0; 9.5.1; 9.5.2; 9.5.3; +1 more
CVE-2026-86227
3.1
1%
Sep 6
valkey-io valkey kvstore.c kvstoreGetHashtable out-of-bounds
Affected: 9.0.0; 9.0.1; 9.0.2; 9.0.3; 9.0.4; 9.0.5; +2 more
CVE-2026-82677
2.4
1%
Aug 31
valkey-io valkey Module Timer module.c moduleTimerHandler double free
Affected: 9.1.0
CVE-2026-82631
2.2
1%
Aug 31
valkey-io valkey Blocked-on-keys blocked.c handleClientsBlockedOnKey use after free
Affected: 9.1.0
Showing 9