CVE-2026-56684highCWE-416

CVE-2026-56684: falha de alta gravidade em valkey-io valkey

Valkey: TLS pending-data processing use-after-free may allow remote code execution

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar valkey+ Monitorar valkey

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 0.5%
Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's tlsProcessPendingData function iterates pending_list while an authenticated client can trigger CLIENT KILL, causing connTLSClose to delete the iterator's cached next node and producing a use-after-free that can crash the server or potentially allow remote code execution when TLS is enabled. This issue is fixed in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
valkey-io · valkey
CVEs relacionadas — valkey-io valkey

No mesmo produto, das mais perigosas para as menos.

CVE-2026-63639HIGHValkey: UAF in stream deserialization may lead to remote code executionEPSS 0.9%CVE-2026-85522MEDIUMvalkey-io valkey Slot Migration cluster_migrateslots.c createSlotImportJob out-of-boundsEPSS 0.9%CVE-2026-21863HIGHMalformed Valkey Cluster bus message can lead to Remote DoSEPSS 0.8%CVE-2025-67733HIGHValkey Affected by RESP Protocol Injection via Lua error_replyEPSS 0.6%CVE-2026-86227LOWvalkey-io valkey kvstore.c kvstoreGetHashtable out-of-boundsEPSS 0.5%CVE-2026-27623HIGHValkey has Pre-Authentication DOS from malformed RESP requestEPSS 0.4%