CVE-2026-63639

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63639", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-17T14:11:15.482Z", "datePublished": "2026-08-18T14:23:52.508Z", "dateUpdated": "2026-08-20T18:36:40.745Z"}, "containers": {"cna": {"title": "Valkey: UAF in stream deserialization may lead to remote code execution", "problemTypes": [{"descriptions": [{"cweId": "CWE-416", "lang": "en", "description": "CWE-416: Use After Free", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/valkey-io/valkey/security/advisories/GHSA-mvcj-73cw-22m4", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/valkey-io/valkey/security/advisories/GHSA-mvcj-73cw-22m4"}, {"name": "https://github.com/valkey-io/valkey/pull/4073", "tags": ["x_refsource_MISC"], "url": "https://github.com/valkey-io/valkey/pull/4073"}, {"name": "https://github.com/valkey-io/valkey/commit/06bc7768fe609f2054e69ccedefe7628f5675da9", "tags": ["x_refsource_MISC"], "url": "https://github.com/valkey-io/valkey/commit/06bc7768fe609f2054e69ccedefe7628f5675da9"}, {"name": "https://github.com/valkey-io/valkey/commit/509cb3c74e8cbc9c0498ebe8b6c93dcd605e7271", "tags": ["x_refsource_MISC"], "url": "https://github.com/valkey-io/valkey/commit/509cb3c74e8cbc9c0498ebe8b6c93dcd605e7271"}, {"name": "https://github.com/valkey-io/valkey/commit/98465eaffe3f95524a5046318bfbc4bdb9798291", "tags": ["x_refsource_MISC"], "url": "https://github.com/valkey-io/valkey/commit/98465eaffe3f95524a5046318bfbc4bdb9798291"}, {"name": "https://github.com/valkey-io/valkey/commit/e95911d4d65be8789fa3705f44d7ed1e65378445", "tags": ["x_refsource_MISC"], "url": "https://github.com/valkey-io/valkey/commit/e95911d4d65be8789fa3705f44d7ed1e65378445"}, {"name": "https://github.com/valkey-io/valkey/commit/f8d2027e8d4df790ac04974bf606408c8ea62778", "tags": ["x_refsource_MISC"], "url": "https://github.com/valkey-io/valkey/commit/f8d2027e8d4df790ac04974bf606408c8ea62778"}, {"name": "https://github.com/valkey-io/valkey/releases/tag/7.2.14", "tags": ["x_refsource_MISC"], "url": "https://github.com/valkey-io/valkey/releases/tag/7.2.14"}, {"name": "https://github.com/valkey-io/valkey/releases/tag/8.0.10", "tags": ["x_refsource_MISC"], "url": "https://github.com/valkey-io/valkey/releases/tag/8.0.10"}, {"name": "https://github.com/valkey-io/valkey/releases/tag/8.1.9", "tags": ["x_refsource_MISC"], "url": "https://github.com/valkey-io/valkey/releases/tag/8.1.9"}, {"name": "https://github.com/valkey-io/valkey/releases/tag/9.0.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/valkey-io/valkey/releases/tag/9.0.5"}, {"name": "https://github.com/valkey-io/valkey/releases/tag/9.1.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/valkey-io/valkey/releases/tag/9.1.1"}], "affected": [{"vendor": "valkey-io", "product": "valkey", "versions": [{"version": "< 7.2.14", "status": "affected"}, {"version": ">= 8.0.0, < 8.0.10", "status": "affected"}, {"version": ">= 8.1.0, < 8.1.9", "status": "affected"}, {"version": ">= 9.0.0, < 9.0.5", "status": "affected"}, {"version": ">= 9.1.0, < 9.1.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-18T14:23:52.508Z"}, "descriptions": [{"lang": "en", "value": "Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when one consumer is deleted while another still references the shared NACK and potentially allowing remote code execution. This issue is fixed in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1."}], "source": {"advisory": "GHSA-mvcj-73cw-22m4", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-19T03:56:16.213417Z", "id": "CVE-2026-63639", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-20T18:36:40.745Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-63639", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-19T03:56:16.213417Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-20T18:36:37.868Z"}}], "cna": {"title": "Valkey: UAF in stream deserialization may lead to remote code execution", "source": {"advisory": "GHSA-mvcj-73cw-22m4", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "valkey-io", "product": "valkey", "versions": [{"status": "affected", "version": "< 7.2.14"}, {"status": "affected", "version": ">= 8.0.0, < 8.0.10"}, {"status": "affected", "version": ">= 8.1.0, < 8.1.9"}, {"status": "affected", "version": ">= 9.0.0, < 9.0.5"}, {"status": "affected", "version": ">= 9.1.0, < 9.1.1"}]}], "references": [{"url": "https://github.com/valkey-io/valkey/security/advisories/GHSA-mvcj-73cw-22m4", "name": "https://github.com/valkey-io/valkey/security/advisories/GHSA-mvcj-73cw-22m4", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/valkey-io/valkey/pull/4073", "name": "https://github.com/valkey-io/valkey/pull/4073", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/valkey-io/valkey/commit/06bc7768fe609f2054e69ccedefe7628f5675da9", "name": "https://github.com/valkey-io/valkey/commit/06bc7768fe609f2054e69ccedefe7628f5675da9", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/valkey-io/valkey/commit/509cb3c74e8cbc9c0498ebe8b6c93dcd605e7271", "name": "https://github.com/valkey-io/valkey/commit/509cb3c74e8cbc9c0498ebe8b6c93dcd605e7271", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/valkey-io/valkey/commit/98465eaffe3f95524a5046318bfbc4bdb9798291", "name": "https://github.com/valkey-io/valkey/commit/98465eaffe3f95524a5046318bfbc4bdb9798291", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/valkey-io/valkey/commit/e95911d4d65be8789fa3705f44d7ed1e65378445", "name": "https://github.com/valkey-io/valkey/commit/e95911d4d65be8789fa3705f44d7ed1e65378445", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/valkey-io/valkey/commit/f8d2027e8d4df790ac04974bf606408c8ea62778", "name": "https://github.com/valkey-io/valkey/commit/f8d2027e8d4df790ac04974bf606408c8ea62778", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/valkey-io/valkey/releases/tag/7.2.14", "name": "https://github.com/valkey-io/valkey/releases/tag/7.2.14", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/valkey-io/valkey/releases/tag/8.0.10", "name": "https://github.com/valkey-io/valkey/releases/tag/8.0.10", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/valkey-io/valkey/releases/tag/8.1.9", "name": "https://github.com/valkey-io/valkey/releases/tag/8.1.9", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/valkey-io/valkey/releases/tag/9.0.5", "name": "https://github.com/valkey-io/valkey/releases/tag/9.0.5", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/valkey-io/valkey/releases/tag/9.1.1", "name": "https://github.com/valkey-io/valkey/releases/tag/9.1.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when one consumer is deleted while another still references the shared NACK and potentially allowing remote code execution. This issue is fixed in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416: Use After Free"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-18T14:23:52.508Z"}}}, "cveMetadata": {"cveId": "CVE-2026-63639", "state": "PUBLISHED", "dateUpdated": "2026-08-20T18:36:40.745Z", "dateReserved": "2026-07-17T14:11:15.482Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-18T14:23:52.508Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "valkey", "vendor": "valkey-io", "versions": [{"status": "affected", "version": "< 7.2.14"}, {"status": "affected", "version": ">= 8.0.0, < 8.0.10"}, {"status": "affected", "version": ">= 8.1.0, < 8.1.9"}, {"status": "affected", "version": ">= 9.0.0, < 9.0.5"}, {"status": "affected", "version": ">= 9.1.0, < 9.1.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when one consumer is deleted while another still references the shared NACK and potentially allowing remote code execution. This issue is fixed in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1."}, {"lang": "es", "value": "Valkey es una base de datos distribuida de clave-valor. Antes de las versiones 7.2.14, 8.0.10, 8.1.9, 9.0.5 y 9.1.1, el comando RESTORE de Valkey acepta una carga \u00fatil de flujo RDB malformada que asigna un NACK de lista de entradas pendientes a m\u00faltiples consumidores durante la deserializaci\u00f3n del grupo de consumidores de flujo, causando un uso despu\u00e9s de liberaci\u00f3n cuando un consumidor es eliminado mientras otro sigue referenciando el NACK compartido y potencialmente permitiendo la ejecuci\u00f3n remota de c\u00f3digo. Este problema est\u00e1 solucionado en las versiones 7.2.14, 8.0.10, 8.1.9, 9.0.5 y 9.1.1."}], "id": "CVE-2026-63639", "lastModified": "2026-10-22T22:10:00.250", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63639", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-19T03:56:16.213417Z", "version": "2.0.3"}}]}, "published": "2026-08-18T15:16:56.627", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/valkey-io/valkey/commit/06bc7768fe609f2054e69ccedefe7628f5675da9"}, {"source": "security-advisories@github.com", "url": "https://github.com/valkey-io/valkey/commit/509cb3c74e8cbc9c0498ebe8b6c93dcd605e7271"}, {"source": "security-advisories@github.com", "url": "https://github.com/valkey-io/valkey/commit/98465eaffe3f95524a5046318bfbc4bdb9798291"}, {"source": "security-advisories@github.com", "url": "https://github.com/valkey-io/valkey/commit/e95911d4d65be8789fa3705f44d7ed1e65378445"}, {"source": "security-advisories@github.com", "url": "https://github.com/valkey-io/valkey/commit/f8d2027e8d4df790ac04974bf606408c8ea62778"}, {"source": "security-advisories@github.com", "url": "https://github.com/valkey-io/valkey/pull/4073"}, {"source": "security-advisories@github.com", "url": "https://github.com/valkey-io/valkey/releases/tag/7.2.14"}, {"source": "security-advisories@github.com", "url": "https://github.com/valkey-io/valkey/releases/tag/8.0.10"}, {"source": "security-advisories@github.com", "url": "https://github.com/valkey-io/valkey/releases/tag/8.1.9"}, {"source": "security-advisories@github.com", "url": "https://github.com/valkey-io/valkey/releases/tag/9.0.5"}, {"source": "security-advisories@github.com", "url": "https://github.com/valkey-io/valkey/releases/tag/9.1.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/valkey-io/valkey/security/advisories/GHSA-mvcj-73cw-22m4"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "valkey: Valkey: Remote code execution via use-after-free in stream deserialization", "id": "2517906", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517906"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when one consumer is deleted while another still references the shared NACK and potentially allowing remote code execution. This issue is fixed in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1.", "A flaw was found in Valkey, a distributed key-value database. A remote attacker could exploit a use-after-free vulnerability in the RESTORE command. This occurs when a malformed data stream is processed during stream deserialization, causing a shared resource to be improperly managed. If successfully exploited, this flaw could lead to remote code execution."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, restrict network access to the Valkey instance to only trusted clients and networks. This limits an attacker's ability to send malformed RDB stream payloads to the RESTORE command. Implement firewall rules to block unauthorized access to the Valkey port."}, "name": "CVE-2026-63639", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "valkey", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "valkey", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-18T14:23:52Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-63639\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-63639\nhttps://github.com/valkey-io/valkey/commit/06bc7768fe609f2054e69ccedefe7628f5675da9\nhttps://github.com/valkey-io/valkey/commit/509cb3c74e8cbc9c0498ebe8b6c93dcd605e7271\nhttps://github.com/valkey-io/valkey/commit/98465eaffe3f95524a5046318bfbc4bdb9798291\nhttps://github.com/valkey-io/valkey/commit/e95911d4d65be8789fa3705f44d7ed1e65378445\nhttps://github.com/valkey-io/valkey/commit/f8d2027e8d4df790ac04974bf606408c8ea62778\nhttps://github.com/valkey-io/valkey/pull/4073\nhttps://github.com/valkey-io/valkey/releases/tag/7.2.14\nhttps://github.com/valkey-io/valkey/releases/tag/8.0.10\nhttps://github.com/valkey-io/valkey/releases/tag/8.1.9\nhttps://github.com/valkey-io/valkey/releases/tag/9.0.5\nhttps://github.com/valkey-io/valkey/releases/tag/9.1.1\nhttps://github.com/valkey-io/valkey/security/advisories/GHSA-mvcj-73cw-22m4"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.2.14)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.0.0,8.0.10)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.1.0,8.1.9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.0.0,9.0.5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.1.0,9.1.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "valkey", "source": "cna", "vendor": "valkey-io"}, "product": "valkey", "vendor": "valkey-io"}], "created": "2026-08-18T15:45:06.189530+00:00", "updated": "2026-08-25T15:30:05.664937+00:00", "vendors": ["valkey-io", "valkey-io$PRODUCT$valkey"]}