CVE-2026-56684

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-56684", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-22T16:39:01.044Z", "datePublished": "2026-08-18T14:19:51.047Z", "dateUpdated": "2026-08-19T03:56:13.565Z"}, "containers": {"cna": {"title": "Valkey: TLS pending-data processing use-after-free may allow remote code execution", "problemTypes": [{"descriptions": [{"cweId": "CWE-416", "lang": "en", "description": "CWE-416: Use After Free", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/valkey-io/valkey/security/advisories/GHSA-53mc-f3m3-99vh", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/valkey-io/valkey/security/advisories/GHSA-53mc-f3m3-99vh"}, {"name": "https://github.com/valkey-io/valkey/pull/4234", "tags": ["x_refsource_MISC"], "url": "https://github.com/valkey-io/valkey/pull/4234"}, {"name": "https://github.com/valkey-io/valkey/commit/7cd5bcb7575d750ec2de618db80da58680a10fe3", "tags": ["x_refsource_MISC"], "url": "https://github.com/valkey-io/valkey/commit/7cd5bcb7575d750ec2de618db80da58680a10fe3"}, {"name": "https://github.com/valkey-io/valkey/releases/tag/7.2.14", "tags": ["x_refsource_MISC"], "url": "https://github.com/valkey-io/valkey/releases/tag/7.2.14"}, {"name": "https://github.com/valkey-io/valkey/releases/tag/8.0.10", "tags": ["x_refsource_MISC"], "url": "https://github.com/valkey-io/valkey/releases/tag/8.0.10"}, {"name": "https://github.com/valkey-io/valkey/releases/tag/8.1.9", "tags": ["x_refsource_MISC"], "url": "https://github.com/valkey-io/valkey/releases/tag/8.1.9"}, {"name": "https://github.com/valkey-io/valkey/releases/tag/9.0.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/valkey-io/valkey/releases/tag/9.0.5"}, {"name": "https://github.com/valkey-io/valkey/releases/tag/9.1.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/valkey-io/valkey/releases/tag/9.1.1"}], "affected": [{"vendor": "valkey-io", "product": "valkey", "versions": [{"version": "< 7.2.14", "status": "affected"}, {"version": ">= 8.0.0, < 8.0.10", "status": "affected"}, {"version": ">= 8.1.0, < 8.1.9", "status": "affected"}, {"version": ">= 9.0.0, < 9.0.5", "status": "affected"}, {"version": ">= 9.1.0, < 9.1.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-18T14:19:51.047Z"}, "descriptions": [{"lang": "en", "value": "Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's tlsProcessPendingData function iterates pending_list while an authenticated client can trigger CLIENT KILL, causing connTLSClose to delete the iterator's cached next node and producing a use-after-free that can crash the server or potentially allow remote code execution when TLS is enabled. This issue is fixed in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1."}], "source": {"advisory": "GHSA-53mc-f3m3-99vh", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-18T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-56684"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-19T03:56:13.565Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-56684", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-18T14:55:18.462428Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-18T14:55:23.115Z"}}], "cna": {"title": "Valkey: TLS pending-data processing use-after-free may allow remote code execution", "source": {"advisory": "GHSA-53mc-f3m3-99vh", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "valkey-io", "product": "valkey", "versions": [{"status": "affected", "version": "< 7.2.14"}, {"status": "affected", "version": ">= 8.0.0, < 8.0.10"}, {"status": "affected", "version": ">= 8.1.0, < 8.1.9"}, {"status": "affected", "version": ">= 9.0.0, < 9.0.5"}, {"status": "affected", "version": ">= 9.1.0, < 9.1.1"}]}], "references": [{"url": "https://github.com/valkey-io/valkey/security/advisories/GHSA-53mc-f3m3-99vh", "name": "https://github.com/valkey-io/valkey/security/advisories/GHSA-53mc-f3m3-99vh", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/valkey-io/valkey/pull/4234", "name": "https://github.com/valkey-io/valkey/pull/4234", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/valkey-io/valkey/commit/7cd5bcb7575d750ec2de618db80da58680a10fe3", "name": "https://github.com/valkey-io/valkey/commit/7cd5bcb7575d750ec2de618db80da58680a10fe3", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/valkey-io/valkey/releases/tag/7.2.14", "name": "https://github.com/valkey-io/valkey/releases/tag/7.2.14", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/valkey-io/valkey/releases/tag/8.0.10", "name": "https://github.com/valkey-io/valkey/releases/tag/8.0.10", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/valkey-io/valkey/releases/tag/8.1.9", "name": "https://github.com/valkey-io/valkey/releases/tag/8.1.9", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/valkey-io/valkey/releases/tag/9.0.5", "name": "https://github.com/valkey-io/valkey/releases/tag/9.0.5", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/valkey-io/valkey/releases/tag/9.1.1", "name": "https://github.com/valkey-io/valkey/releases/tag/9.1.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's tlsProcessPendingData function iterates pending_list while an authenticated client can trigger CLIENT KILL, causing connTLSClose to delete the iterator's cached next node and producing a use-after-free that can crash the server or potentially allow remote code execution when TLS is enabled. This issue is fixed in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416: Use After Free"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-18T14:19:51.047Z"}}}, "cveMetadata": {"cveId": "CVE-2026-56684", "state": "PUBLISHED", "dateUpdated": "2026-08-19T03:56:13.565Z", "dateReserved": "2026-06-22T16:39:01.044Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-18T14:19:51.047Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "valkey", "vendor": "valkey-io", "versions": [{"status": "affected", "version": "< 7.2.14"}, {"status": "affected", "version": ">= 8.0.0, < 8.0.10"}, {"status": "affected", "version": ">= 8.1.0, < 8.1.9"}, {"status": "affected", "version": ">= 9.0.0, < 9.0.5"}, {"status": "affected", "version": ">= 9.1.0, < 9.1.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's tlsProcessPendingData function iterates pending_list while an authenticated client can trigger CLIENT KILL, causing connTLSClose to delete the iterator's cached next node and producing a use-after-free that can crash the server or potentially allow remote code execution when TLS is enabled. This issue is fixed in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1."}, {"lang": "es", "value": "Valkey es una base de datos distribuida de clave-valor. Antes de 7.2.14, 8.0.10, 8.1.9, 9.0.5 y 9.1.1, la funci\u00f3n tlsProcessPendingData de Valkey itera pending_list mientras un cliente autenticado puede activar CLIENT KILL, haciendo que connTLSClose elimine el siguiente nodo en cach\u00e9 del iterador y produciendo un uso despu\u00e9s de liberaci\u00f3n que puede bloquear el servidor o potencialmente permitir la ejecuci\u00f3n remota de c\u00f3digo cuando TLS est\u00e1 habilitado. Este problema est\u00e1 solucionado en las versiones 7.2.14, 8.0.10, 8.1.9, 9.0.5 y 9.1.1."}], "id": "CVE-2026-56684", "lastModified": "2026-10-22T22:10:00.250", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-56684", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-18T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-08-18T15:16:55.463", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/valkey-io/valkey/commit/7cd5bcb7575d750ec2de618db80da58680a10fe3"}, {"source": "security-advisories@github.com", "url": "https://github.com/valkey-io/valkey/pull/4234"}, {"source": "security-advisories@github.com", "url": "https://github.com/valkey-io/valkey/releases/tag/7.2.14"}, {"source": "security-advisories@github.com", "url": "https://github.com/valkey-io/valkey/releases/tag/8.0.10"}, {"source": "security-advisories@github.com", "url": "https://github.com/valkey-io/valkey/releases/tag/8.1.9"}, {"source": "security-advisories@github.com", "url": "https://github.com/valkey-io/valkey/releases/tag/9.0.5"}, {"source": "security-advisories@github.com", "url": "https://github.com/valkey-io/valkey/releases/tag/9.1.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/valkey-io/valkey/security/advisories/GHSA-53mc-f3m3-99vh"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "valkey: Valkey: Remote code execution via TLS pending-data processing use-after-free", "id": "2517907", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517907"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's tlsProcessPendingData function iterates pending_list while an authenticated client can trigger CLIENT KILL, causing connTLSClose to delete the iterator's cached next node and producing a use-after-free that can crash the server or potentially allow remote code execution when TLS is enabled. This issue is fixed in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1.", "A flaw was found in Valkey. An authenticated client can trigger a `CLIENT KILL` command while the `tlsProcessPendingData` function iterates a pending list. This action causes `connTLSClose` to delete the iterator's cached next node, leading to a use-after-free vulnerability. This flaw, when Transport Layer Security (TLS) is enabled, may result in a server crash or potentially allow a remote attacker to achieve arbitrary code execution."], "mitigation": {"lang": "en:us", "value": "Restrict network access to the Valkey instance to trusted clients and networks by configuring firewall rules to limit inbound connections to the Valkey service port. Ensure only authorized and authenticated clients can connect. If TLS is not strictly required, consider disabling it. These network restrictions will persist if the Valkey service is reloaded or restarted."}, "name": "CVE-2026-56684", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "valkey", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "valkey", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-18T14:19:51Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-56684\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-56684\nhttps://github.com/valkey-io/valkey/commit/7cd5bcb7575d750ec2de618db80da58680a10fe3\nhttps://github.com/valkey-io/valkey/pull/4234\nhttps://github.com/valkey-io/valkey/releases/tag/7.2.14\nhttps://github.com/valkey-io/valkey/releases/tag/8.0.10\nhttps://github.com/valkey-io/valkey/releases/tag/8.1.9\nhttps://github.com/valkey-io/valkey/releases/tag/9.0.5\nhttps://github.com/valkey-io/valkey/releases/tag/9.1.1\nhttps://github.com/valkey-io/valkey/security/advisories/GHSA-53mc-f3m3-99vh"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.2.14)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.0.0,8.0.10)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.1.0,8.1.9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.0.0,9.0.5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.1.0,9.1.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "valkey", "source": "cna", "vendor": "valkey-io"}, "product": "valkey", "vendor": "valkey-io"}], "created": "2026-08-18T15:45:06.189823+00:00", "updated": "2026-08-25T15:30:05.668612+00:00", "vendors": ["valkey-io", "valkey-io$PRODUCT$valkey"], "weaknesses": ["CWE-416", "CWE-825"]}