Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when one consumer is deleted while another still references the shared NACK and potentially allowing remote code execution. This issue is fixed in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
valkey-io valkey affected
Version Status Constraints
< 7.2.14 affected —
>= 8.0.0, < 8.0.10 affected —
>= 8.1.0, < 8.1.9 affected —
>= 9.0.0, < 9.0.5 affected —
>= 9.1.0, < 9.1.1 affected —

No data.

No data.

No data.

Project Subscriptions

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://github.com/valkey-io/valkey/commit/06bc7768fe609f2054e69ccedefe7628f5675da9 cve-icon
https://github.com/valkey-io/valkey/commit/509cb3c74e8cbc9c0498ebe8b6c93dcd605e7271 cve-icon
https://github.com/valkey-io/valkey/commit/98465eaffe3f95524a5046318bfbc4bdb9798291 cve-icon
https://github.com/valkey-io/valkey/commit/e95911d4d65be8789fa3705f44d7ed1e65378445 cve-icon
https://github.com/valkey-io/valkey/commit/f8d2027e8d4df790ac04974bf606408c8ea62778 cve-icon
https://github.com/valkey-io/valkey/pull/4073 cve-icon
https://github.com/valkey-io/valkey/releases/tag/7.2.14 cve-icon
https://github.com/valkey-io/valkey/releases/tag/8.0.10 cve-icon
https://github.com/valkey-io/valkey/releases/tag/8.1.9 cve-icon
https://github.com/valkey-io/valkey/releases/tag/9.0.5 cve-icon
https://github.com/valkey-io/valkey/releases/tag/9.1.1 cve-icon
https://github.com/valkey-io/valkey/security/advisories/GHSA-mvcj-73cw-22m4 cve-icon
History

Tue, 18 Aug 2026 14:30:00 +0000

Type Values Removed Values Added
Description Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when one consumer is deleted while another still references the shared NACK and potentially allowing remote code execution. This issue is fixed in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1.
Title Valkey: UAF in stream deserialization may lead to remote code execution
Weaknesses CWE-416
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-18T14:23:52.508Z

Reserved: 2026-07-17T14:11:15.482Z

Link: CVE-2026-63639

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses