CVE-2026-56684

Published: Aug 18, 2026Modified: Aug 19, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.6 / Impact: 5.9

Source: security-advisories@github.com (Secondary)

Description

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's tlsProcessPendingData function iterates pending_list while an authenticated client can trigger CLIENT KILL, causing connTLSClose to delete the iterator's cached next node and producing a use-after-free that can crash the server or potentially allow remote code execution when TLS is enabled. This issue is fixed in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1.

Related CWEs

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

References (8)

https://github.com/valkey-io/valkey/commit/7cd5bcb7575d750ec2de618db80da58680a10fe3

Source: security-advisories@github.com

https://github.com/valkey-io/valkey/pull/4234

Source: security-advisories@github.com

https://github.com/valkey-io/valkey/releases/tag/7.2.14

Source: security-advisories@github.com

https://github.com/valkey-io/valkey/releases/tag/8.0.10

Source: security-advisories@github.com

https://github.com/valkey-io/valkey/releases/tag/8.1.9

Source: security-advisories@github.com

https://github.com/valkey-io/valkey/releases/tag/9.0.5

Source: security-advisories@github.com

https://github.com/valkey-io/valkey/releases/tag/9.1.1

Source: security-advisories@github.com

https://github.com/valkey-io/valkey/security/advisories/GHSA-53mc-f3m3-99vh

Source: security-advisories@github.com

Timeline

No history available yet.