CVE-2026-56684: Valkey: TLS pending-data processing use-after-free may allow remote code execution
Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's tlsProcessPendingData function iterates pendinglist while an authenticated client can trigger CLIENT KILL, causing connTLSClose to delete the iterator's cached next node and producing a use-after-free that can crash the server or potentially allow remote code execution when TLS is enabled. This issue is fixed in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Valkeyto a version that resolves this vulnerability.Fixed in 7.2.14 - Upgrade
Upgrade
Valkeyto a version that resolves this vulnerability.Fixed in 8.0.10 - Upgrade
Upgrade
Valkeyto a version that resolves this vulnerability.Fixed in 8.1.9 - Upgrade
Upgrade
Valkeyto a version that resolves this vulnerability.Fixed in 9.0.5 - Upgrade
Upgrade
Valkeyto a version that resolves this vulnerability.Fixed in 9.1.1
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments are affected when TLS is enabled and run a version earlier than 7.2.14, 8.0.10, 8.1.9, 9.0.5, or 9.1.1.
What access does an attacker need?
An attacker needs to be an authenticated client and be able to trigger CLIENT KILL while TLS pending data is processed. No user interaction is required.
What is the remediation?
Upgrade to the fixed release for the applicable branch: 7.2.14, 8.0.10, 8.1.9, 9.0.5, or 9.1.1.
How can I determine whether an instance is affected?
Check whether TLS is enabled and compare the running Valkey version with the fixed version for its release branch. Versions earlier than the listed fixes are affected under the stated TLS condition.