Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when one consumer is deleted while another still references the shared NACK and potentially allowing remote code execution. This issue is fixed in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:64796 advisory.

    * redis: Redis: Remote Code Execution via specially crafted RESTORE payload (CVE-2026-66373)
      * valkey: Valkey: Remote code execution via use-after-free in stream deserialization (CVE-2026-63639)
      * valkey: Valkey: Remote code execution via TLS pending-data processing use-after-free (CVE-2026-56684)


    Bug Fix(es) and Enhancement(s):

      * [Tracker] Rebase valkey to 8.0.10 (JIRA:AlmaLinux-216776)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:64807 advisory.

    * redis: Redis: Remote Code Execution via specially crafted RESTORE payload (CVE-2026-66373)
      * valkey: Valkey: Remote code execution via use-after-free in stream deserialization (CVE-2026-63639)
      * valkey: Valkey: Remote code execution via TLS pending-data processing use-after-free (CVE-2026-56684)


    Bug Fix(es) and Enhancement(s):

      * [Tracker] Rebase valkey to 8.0.10 (JIRA:AlmaLinux-216778)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:64796 advisory.

    * redis: Redis: Remote Code Execution via specially crafted RESTORE payload (CVE-2026-66373)

    * valkey: Valkey: Remote code execution via use-after-free in stream deserialization (CVE-2026-63639)

    * valkey: Valkey: Remote code execution via TLS pending-data processing use-after-free (CVE-2026-56684)

    Bug Fix(es) and Enhancement(s):

    * [Tracker] Rebase valkey to 8.0.10 (JIRA:Rocky Linux-216776)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:64807 advisory.

    * redis: Redis: Remote Code Execution via specially crafted RESTORE payload (CVE-2026-66373)

    * valkey: Valkey: Remote code execution via use-after-free in stream deserialization (CVE-2026-63639)

    * valkey: Valkey: Remote code execution via TLS pending-data processing use-after-free (CVE-2026-56684)

    Bug Fix(es) and Enhancement(s):

    * [Tracker] Rebase valkey to 8.0.10 (JIRA:Rocky Linux-216778)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-648070 advisory.

    [8.0.10-1]
    - Rebase to 8.0.10 for CVE-2026-56684 CVE-2026-63639 (CVE-2026-66373 in redis)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-647960 advisory.

    [8.0.11-1]
    - Rebase to 8.0.11 for CVE-2026-56684 CVE-2026-63639 (CVE-2026-66373 in redis)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:64807 advisory.

    Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can     contain strings, hashes, lists, sets and sorted sets.  You can run atomic operations on these types, like     appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection,     union and difference; or getting the member with highest ranking in a sorted set.  In order to achieve its     outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can     persist it either by dumping the dataset to disk every once in a while, or by appending each command to a     log.  Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first     synchronization, auto-reconnection on net split and so forth.  Other features include Transactions,     Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave     like a cache.  You can use Valkey from most programming languages also.

    Security Fix(es):

    * redis: Redis: Remote Code Execution via specially crafted RESTORE payload (CVE-2026-66373)

    * valkey: Valkey: Remote code execution via use-after-free in stream deserialization (CVE-2026-63639)

    * valkey: Valkey: Remote code execution via TLS pending-data processing use-after-free (CVE-2026-56684)

    Bug Fix(es) and Enhancement(s):

    * [Tracker] Rebase valkey to 8.0.10 (JIRA:RHEL-216778)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:64796 advisory.

    Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can     contain strings, hashes, lists, sets and sorted sets.  You can run atomic operations on these types, like     appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection,     union and difference; or getting the member with highest ranking in a sorted set.  In order to achieve its     outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can     persist it either by dumping the dataset to disk every once in a while, or by appending each command to a     log.  Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first     synchronization, auto-reconnection on net split and so forth.  Other features include Transactions,     Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave     like a cache.  You can use Valkey from most programming languages also.

    Security Fix(es):

    * redis: Redis: Remote Code Execution via specially crafted RESTORE payload (CVE-2026-66373)

    * valkey: Valkey: Remote code execution via use-after-free in stream deserialization (CVE-2026-63639)

    * valkey: Valkey: Remote code execution via TLS pending-data processing use-after-free (CVE-2026-56684)

    Bug Fix(es) and Enhancement(s):

    * [Tracker] Rebase valkey to 8.0.10 (JIRA:RHEL-216776)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's     RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to     multiple consumers during stream consumer-group deserialization, causing a use-after-free when one     consumer is deleted while another still references the shared NACK and potentially allowing remote code     execution. This issue is fixed in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1. (CVE-2026-63639)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3483-1 advisory.

    This update for valkey fixes the following issues

    - CVE-2026-56684: use-after-free in TLS connection handling (bsc#1272443).
    - CVE-2026-63639: RCE via corrupt stream RDB files containing a shared NACK       across consumers (bsc#1272442).

    Changes for valkey:

    - Update to 8.0.10.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2011 advisory.

    A use-after-free vulnerability exists in Valkey's TLS connection handling that can crash the server that     can potentially lead to remote code execution. When TLS is enabled, the server keeps a list of connections     that have leftover data waiting to be read. While working through that list, one connection being closed     can cause Valkey to access memory belonging to another connection that was just freed.

    This happens when an authenticated client closes a connection (for example, via CLIENT KILL) while another     TLS connection still has buffered data pending. The freed memory could in principle be reclaimed and     controlled via heap grooming which can lead to a potential remote code execution.

    This issue only affects deployments with TLS enabled. Non-TLS deployments are not affected.
    (CVE-2026-56684)

    An authenticated user may use a specially crafted RESTORE command to inject a malformed RDB payload     containing duplicate Pending Entry List (PEL) assignments. This triggers a use-after-free during stream     consumer group deserialization or consumer deletion, potentially leading to remote code execution.

    The problem exists in all versions of Valkey. (CVE-2026-63639)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21485-1 advisory.

    Update to version 8.0.10.

    - CVE-2026-56684: RCE via CLIENT KILL due to use-after-free in TLS connection handling (bsc#1272443).
    - CVE-2026-63639: RCE via corrupt stream RDB files due to use-after-free when loading a stream consumer     group from RDB       (bsc#1272442).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3427-1 advisory.

    - CVE-2026-56684: use-after-free in TLS connection handling that could allow an authenticated client to     achieve remote       code execution using CLIENT KILL (bsc#1272443).
    - CVE-2026-63639: corrupt stream RDB files containing a shared NACK across consumers can lead to remote     code execution       (bsc#1272442).

    Changes for valkey:

    - Update to 8.0.10.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-9de44775c7 advisory.

    ## Valkey 8.1.9  -  Released Tue 21 July 2026

    Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible.

    ### Security Fixes

    * **CVE-2026-56684**: Fix a use-after-free in TLS connection handling that could allow an authenticated     client to achieve remote code execution using CLIENT KILL (#4234)
    * **CVE-2026-63639**: Reject corrupt stream RDB files containing a shared NACK across consumers, which     could allow remote code execution. Reported by @z0v3r1n and @lifip. (#4073)

    ### Bug Fixes

    * Fix clients being left on the wrong database after module keyspace notifications from commands like     `MOVE` and `COPY` by @enjoy-binbin (#4024)
    * Fix an I/O thread job queue memory-ordering race that could trigger an assertion crash on ARM/aarch64 by     @jjuleslasarte (#3878)
    * Reject zipmap `RESTORE` payloads with overflowing length fields that could cause out-of-bounds access on     32-bit builds by @madolson (#3920)
    * Reject NAN scores when loading listpack/ziplist-encoded sorted sets, preventing a crash from crafted     `RESTORE` payloads by @madolson (#3921)
    * Fix a startup crash when generating `INFO` output on 32-bit systems where `time_t` is 64-bit (e.g.
    Alpine time64) by @chenshi5012 (#3787)
    * Fix `COMMAND INFO` in RESP3 to reply with an empty Array instead of a Set for commands without     subcommands by @rickrams (#3939)
    * Reject invalid characters in cluster AUX fields and `cluster-announce-ip` to prevent `nodes.conf`     corruption and injection by @eifrah-aws (#3848)
    * Fix `lua-enable-insecure-api` having no effect when enabled at startup via config file or command line     by @enjoy-binbin (#3548)
    * Increase the maximum process title length from 255 to 1024 characters to avoid truncation with long     installation paths by @pkhartsk (#3843)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3d18a65cc4 advisory.

    ## Valkey 9.0.5  -  Released Tue 21 July 2026

    Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible.

    ### Security Fixes

    * **CVE-2026-56684**: Fix a use-after-free in TLS connection handling that could allow an authenticated     client to achieve remote code execution using CLIENT KILL (#4234)
    * **CVE-2026-63639**: Reject corrupt stream RDB files containing a shared NACK across consumers, which     could allow remote code execution. Reported by @z0v3r1n and @lifip. (#4073)

    ### Bug Fixes

    * Strictly validate CRLF terminators when parsing the RESP protocol; malformed requests now get a protocol     error instead of being misparsed by @enjoy-binbin (#2872)
    * Fix a use-after-free crash when creating slot import jobs during manual slot migrations by @twooster     (#3283)
    * Fix a memory leak in ZDIFF and ZDIFFSTORE when the result set becomes empty before all inputs are     processed by @sarthakaggarwal97 (#3342)
    * Fix HPERSIST sending a malformed reply that desynchronized the connection when used on a key of the     wrong type by @madolson (#3516)
    * Fix a crash from a race between IO threads and asynchronous client freeing by @deepakrn (#3458)
    * Fix a double free when loading a stream with corrupt consumer PEL data from RDB or RESTORE by @enjoy-     binbin (#3498)
    * Fix listpack corruption and a subsequent crash when XTRIM marks the last entry of a stream listpack node     as deleted by @smkher (#3591)
    * Fix malformed replies when module callbacks build deferred-length arrays while a client's deferred reply     buffer is active by @eifrah-aws (#3578)
    * Fix a NULL pointer crash in TLS pending-data handling by @zuiderkwast (#3641)
    * Fix a server crash when multiple RDMA clients disconnect at the same time by @quanyeyang (#3448)
    * Fix a use-after-free when ACL LOAD deletes a user whose clients cannot be freed immediately by @ranshid     (#3800)
    * Fix a use-after-free when a module unregisters the first registered cluster message receiver for a     message type by @eifrah-aws (#3846)
    * Fix HRANDFIELD looping forever when a hash has fewer non-expired fields than the requested count by     @cjx-zar (#4047)
    * Fix clients being left on the wrong database after module keyspace notifications for commands like MOVE     and COPY by @enjoy-binbin (#4024)
    * Fix a Sentinel crash during coordinated failover when the connection to the old primary is disconnected     by @lukepalmer (#4068)
    * Fix underestimation of client output buffer memory when replies reference shared objects, so buffer     limits are enforced correctly by @dvkashapov (#3306)
    * Fix a crash on ARM/aarch64 caused by memory-ordering races in the IO thread job queue by @jjuleslasarte     (#3878)
    * Fix a crash when active hash field expiration leaves a single entry in a large expiration time-bucket by     @ranshid (#3950)
    * Fix a file descriptor leak when a blocking connection attempt, such as MIGRATE to an unreachable host,     times out by @madolson (#3541)
    * Fix a potential crash from a dangling slot migration job reference when the migration client is reset by     @murphyjacob4 (#3554)
    * Remove cached EVAL scripts when their scripting engine is unregistered, preventing dangling engine     references by @eifrah-aws (#3503)
    * Fix a memory leak in GEOSEARCH BYPOLYGON when argument parsing fails, such as on an invalid COUNT by     @bandalgomsu (#3568)
    * Fix a crash when a slot migration target node is removed from the cluster before the migration connects     by @chenshi5012 (#3596)
    * Fix a crash when the module GetLRU/SetLRU/GetLFU/SetLFU APIs are called with a NULL key by @yaronsananes     (#3610)
    * Fix an assertion failure in hash field expiration commands when a module blocks the client in a keyspace     notification by @enjoy-binbin (#3743)
    * Fix a cluster UPDATE log message reading shard IDs past their fixed-length buffer by @enjoy-binbin     (#3942)
    * Fix undefined behavior in the failover delay calculation when cluster-node-timeout is set below 30     milliseconds by @enjoy-binbin (#3941)
    * Reject zipmap RESTORE payloads with overflowing length fields that could cause out-of-bounds access on     32-bit builds by @madolson (#3920)
    * Reject NAN scores in listpack- and ziplist-encoded sorted sets on RDB/RESTORE load, preventing a later     crash on skiplist conversion by @madolson (#3921)
    * Fix a startup crash on 32-bit systems with 64-bit time_t, such as Alpine 3.23, caused by time value     formatting mismatches by @chenshi5012 (#3787)
    * Fix corrupted client replies when IO threads are enabled, caused by a race between in-flight writes and     reply buffer reuse by @nanyan0312 (#4060)
    * COMMAND INFO in RESP3 now returns the subcommands field as an Array instead of a Set for commands     without subcommands by @rickrams (#3939)
    * The dual-channel replication RDB connection now announces the configured replica-announce-ip, avoiding     stale replica entries behind NAT by @jdheyburn (#2846)
    * Prevent replicas from processing stale cluster packets and incorrectly promoting themselves to an empty     primary within a shard by @zhijun42 (#2811)
    * Send the replica version on the dual-channel RDB connection so full syncs of data like hash field TTLs     no longer fail by @hpatro (#4105)
    * Fix slot migration failure handling running twice on ownership changes and an out-of-order error reply     in the internal SYNCSLOTS FINISH command by @chx9 (#3723)
    * Allow slot-migration-max-failover-repl-bytes to be set to -1 to disable the limit, as documented by     @enjoy-binbin (#3443)
    * Fix CONFIG REWRITE producing negative values for memory configs such as maxmemory when set to very large     values by @enjoy-binbin (#3440)
    * Reject SENTINEL SET values containing control characters and safely quote Sentinel config values to     prevent config file injection by @eifrah-aws (#3847)
    * Reject control characters and delimiters in cluster AUX fields and validate cluster-announce-ip to     prevent nodes.conf corruption or injection by @eifrah-aws (#3848)
    * Fix changes to lua-enable-insecure-api via CONFIG SET not taking effect when the option was set at     startup by @enjoy-binbin (#4182)
    * Fix incorrect memory overhead reported for watched keys in client memory usage tracking by @enjoy-binbin     (#3359)
    * Replica logs now report 'Connection reset by peer' instead of the misleading 'Success' when the primary     closes the connection by @abmathur-ie (#3580)
    * Redact key names and user data from more log messages when hide-user-data-from-log is enabled by     @zackcam (#3872)
    * Fix INFO replication reporting negative sync transfer sizes when the RDB exceeds 2GB during disk-based     sync by @chx9 (#3811)
    * Increase the maximum process title length from 255 to 1024 characters to avoid truncation with long     installation paths by @pkhartsk (#3843)
    * valkey-cli --cluster del-node can now remove unreachable or failed nodes instead of failing with 'No     such node ID' by @yang-z-o (#3209)
    * Fix valkey-cli crashing after --eval script execution on jemalloc/tcmalloc builds by @bandalgomsu     (#3281)
    * valkey-cli --cluster fix now spreads uncovered slots randomly across primaries instead of assigning them     all to one node by @abmathur-ie (#3586)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
344505	AlmaLinux 10 : valkey (ALSA-2026:64796)	Nessus	Alma Linux Local Security Checks	Local	high
344333	AlmaLinux 9 : valkey (ALSA-2026:64807)	Nessus	Alma Linux Local Security Checks	Local	high
344058	RockyLinux 10 : valkey (RLSA-2026:64796)	Nessus	Rocky Linux Local Security Checks	Local	high
344047	RockyLinux 9 : valkey (RLSA-2026:64807)	Nessus	Rocky Linux Local Security Checks	Local	high
343902	Oracle Linux 9 : ELSA-2026-64807-0: / valkey (ELSA-2026-648070)	Nessus	Oracle Linux Local Security Checks	Local	high
343900	Oracle Linux 10 : ELSA-2026-64796-0: / valkey (ELSA-2026-647960)	Nessus	Oracle Linux Local Security Checks	Local	high
343809	RHEL 9 : valkey (RHSA-2026:64807)	Nessus	Red Hat Local Security Checks	Local	high
343764	RHEL 10 : valkey (RHSA-2026:64796)	Nessus	Red Hat Local Security Checks	Local	high
338096	Linux Distros Unpatched Vulnerability : CVE-2026-63639	Nessus	Misc.	Local	high
332123	SUSE SLES15 Security Update : valkey (SUSE-SU-2026:3483-1)	Nessus	SuSE Local Security Checks	Local	high
332040	Amazon Linux 2023 : valkey, valkey-devel (ALAS2023-2026-2011)	Nessus	Amazon Linux Local Security Checks	Local	high
331557	openSUSE 16 Security Update : valkey (openSUSE-SU-2026:21485-1)	Nessus	SuSE Local Security Checks	Local	high
331468	SUSE SLES15 Security Update : valkey (SUSE-SU-2026:3427-1)	Nessus	SuSE Local Security Checks	Local	high
331338	Fedora 43 : valkey (2026-9de44775c7)	Nessus	Fedora Local Security Checks	Local	high
331316	Fedora 44 : valkey (2026-3d18a65cc4)	Nessus	Fedora Local Security Checks	Local	high

Detections

Analytics

CVE-2026-63639

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high