CVE-2026-56684
Received Received - Intake

Use-After-Free in Valkey TLS Connection Handling

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description
Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's tlsProcessPendingData function iterates pending_list while an authenticated client can trigger CLIENT KILL, causing connTLSClose to delete the iterator's cached next node and producing a use-after-free that can crash the server or potentially allow remote code execution when TLS is enabled. This issue is fixed in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-56684
EUVD
EUVD-2026-60822

Affected Vendors & Products

Showing 15 associated CPEs
Vendor Product Version / Range
valkey valkey 7.2.14
valkey valkey 8.0.10
valkey valkey 8.1.9
valkey valkey 9.0.5
valkey valkey 9.1.1
valkey valkey to 9.1.0 (inc)
valkey valkey to 7.2.14 (exc)
valkey valkey to 8.0.10 (exc)
valkey valkey to 8.1.9 (exc)
valkey valkey to 9.0.5 (exc)
valkey valkey to 7.2.14 (inc)
valkey valkey to 8.0.10 (inc)
valkey valkey to 8.1.9 (inc)
valkey valkey to 9.0.5 (inc)
valkey valkey to 9.1.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-56684 is a use-after-free vulnerability in Valkey's TLS connection handling. It occurs in the tlsProcessPendingData function when iterating pending TLS connections. An authenticated client can trigger CLIENT KILL during this iteration, causing the function to free a connection still in the list. This invalidates the iterator's cached next node, leading to a use-after-free that may crash the server or allow remote code execution when TLS is enabled.

Detection Guidance

This vulnerability is only exploitable when TLS is enabled in Valkey. Check if your Valkey server is running with TLS by inspecting the configuration file for TLS-related settings like tls-port or tls-cert-file. Use commands like 'redis-cli config get tls-port' or 'redis-cli config get tls-cert-file' to verify.

Impact Analysis

This vulnerability allows an authenticated attacker to crash the Valkey server (denial-of-service) or potentially execute arbitrary code remotely. The impact depends on server configuration and TLS usage. Exploitation requires an authenticated client connection and TLS to be enabled. Non-TLS deployments are unaffected.

Mitigation Strategies

Upgrade Valkey to a patched version (7.2.14, 8.0.10, 8.1.9, 9.0.5, or 9.1.1) immediately. If upgrading is not possible, disable TLS if not required, restrict CLIENT commands via ACLs, or implement network isolation to limit exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-56684. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart