CVE-2026-56684
Fixed in a distro release EPSS <1%CVSS 7.5
Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's tlsProcessPendingData function iterates pending_list while an authenticated client can trigger CLIENT KILL, causing connTLSClose to delete the iterator's cached next node and producing a use-after-free that can crash the server or potentially allow remote code execution when TLS is enabled. This issue is fixed in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1.
Products: valkey-io valkey
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux:10 | valkey | 8.0.11-1.el10_2 |
| AlmaLinux:10 | valkey-devel | 8.0.11-1.el10_2 |
| AlmaLinux:9 | valkey | 8.0.10-1.el9_8 |
| AlmaLinux:9 | valkey-devel | 8.0.10-1.el9_8 |
| Debian:13 | valkey | no fix |
| Debian:14 | redict | no fix |
| Debian:14 | valkey | 9.1.1-1 |
| Red Hat:enterprise_linux:10.2 | valkey | 0:8.0.11-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | valkey-debuginfo | 0:8.0.11-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | valkey-debugsource | 0:8.0.11-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | valkey-devel | 0:8.0.11-1.el10_2 |
| Red Hat:enterprise_linux:9 | valkey | 0:8.0.10-1.el9_8 |
| Red Hat:enterprise_linux:9 | valkey-debuginfo | 0:8.0.10-1.el9_8 |
| Red Hat:enterprise_linux:9 | valkey-debugsource | 0:8.0.10-1.el9_8 |
| Red Hat:enterprise_linux:9 | valkey-devel | 0:8.0.10-1.el9_8 |
| Red Hat:enterprise_linux_eus:10.0 | valkey | 0:8.0.11-1.el10_0 |
| Red Hat:enterprise_linux_eus:10.0 | valkey-debuginfo | 0:8.0.11-1.el10_0 |
| Red Hat:enterprise_linux_eus:10.0 | valkey-debugsource | 0:8.0.11-1.el10_0 |
| Red Hat:enterprise_linux_eus:10.0 | valkey-devel | 0:8.0.11-1.el10_0 |
| Red Hat:hummingbird:1 | valkey | 0:9.0.6-0.1.hum1 |
| Red Hat:hummingbird:1 | valkey-compat-redis | 0:9.0.6-0.1.hum1 |
| Red Hat:hummingbird:1 | valkey-compat-redis-devel | 0:9.0.6-0.1.hum1 |
| Red Hat:hummingbird:1 | valkey-devel | 0:9.0.6-0.1.hum1 |
| Red Hat:hummingbird:1 | valkey-doc | 0:9.0.6-0.1.hum1 |
| Red Hat:hummingbird:1 | valkey-rdma | 0:9.0.6-0.1.hum1 |
| Rocky Linux:10 | valkey | 0:8.0.11-1.el10_2 |
| Rocky Linux:9 | valkey | 0:8.0.10-1.el9_8 |
| SUSE:Linux Enterprise Module for Server Applications 15 SP7 | valkey | 8.0.10-150700.3.20.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | valkey | 8.0.10-150600.13.28.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | valkey | 8.0.10-150600.13.28.1 |
| Ubuntu:26.04:LTS | valkey | 9.0.4-0ubuntu0.2 |
| Ubuntu:Pro:24.04:LTS | valkey | 7.2.13+dfsg1-0ubuntu0.1+esm1 |
| openSUSE:Leap 16.0 | valkey | 8.0.10-160000.1.1 |
| openSUSE:Tumbleweed | valkey | 9.1.1-1.1 |