CVE-2026-63639
Received Received - Intake

Use-After-Free in Valkey During Stream Consumer-Group Deserialization

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description
Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when one consumer is deleted while another still references the shared NACK and potentially allowing remote code execution. This issue is fixed in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-63639
EUVD
EUVD-2026-60823

Affected Vendors & Products

Showing 10 associated CPEs
Vendor Product Version / Range
valkey valkey to 9.1.0 (inc)
valkey valkey to 9.0.4 (inc)
valkey valkey to 8.1.8 (inc)
valkey valkey to 8.0.9 (inc)
valkey valkey to 7.2.13 (inc)
valkey valkey 7.2.14
valkey valkey 8.0.10
valkey valkey 8.1.9
valkey valkey 9.0.5
valkey valkey 9.1.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a use-after-free flaw in Valkey, a Redis fork, affecting stream consumer groups. It occurs when a maliciously crafted RDB file assigns the same Pending Entry List NACK to multiple consumers during deserialization. This creates a shared NACK structure that can be freed while still referenced by another consumer, leading to memory corruption and potential remote code execution.

Detection Guidance

Detecting this vulnerability requires checking Valkey versions and monitoring for malformed RDB files. Use 'valkey-cli info server' to check the version. If vulnerable, upgrade immediately. Monitor logs for RESTORE command errors or crashes during stream operations.

Impact Analysis

An authenticated attacker could exploit this by sending a crafted RESTORE command with a corrupt RDB payload. This may allow remote code execution, leading to unauthorized access, data theft, or system compromise. The high CVSS score indicates significant risk due to network exposure and low attack complexity.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating confidentiality and integrity requirements in GDPR and HIPAA. Organizations using affected Valkey versions may face compliance violations, data breach notifications, and potential fines if exploited.

Mitigation Strategies
  • Upgrade Valkey to patched versions: 7.2.14, 8.0.10, 8.1.9, 9.0.5, or 9.1.1.
  • Restrict access to the RESTORE command via ACLs or configuration changes if upgrading is not immediately possible.
  • Avoid loading untrusted RDB files or dumps to prevent exploitation through malformed payloads.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63639. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart