CVE-2026-56684
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk57th percentile - higher than 57% of all known CVEs
Summary
Valkey, a distributed key-value database, contains a use-after-free vulnerability in the tlsProcessPendingData function. An authenticated client can trigger CLIENT KILL, causing deletion of a node from the list and potentially leading to server crash or remote code execution when TLS is enabled. The issue is fixed in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1.
Risk Assessment
An attacker with server access can cause a crash or take over the server, potentially leading to data integrity and availability issues.
Recommendation
Immediately upgrade Valkey to one of the patched versions (7.2.14, 8.0.10, 8.1.9, 9.0.5, or 9.1.1).
Original NVD description (English source)
Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's tlsProcessPendingData function iterates pending_list while an authenticated client can trigger CLIENT KILL, causing connTLSClose to delete the iterator's cached next node and producing a use-after-free that can crash the server or potentially allow remote code execution when TLS is enabled. This issue is fixed in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1.