CVE-2026-56684

Valkey, the Linux Foundation's Redis-compatible distributed key-value database, contains a use-after-free (CWE-416) in its tlsProcessPendingData function on servers with TLS enabled. While that function iterates the TLS pending-data list, an authenticated client can issue CLIENT KILL, causing connTLSClose to delete the iterator's cached next node and triggering the memory-safety error. An attacker with low-privileged authenticated access can crash the server (denial of service) and potentially achieve remote code execution. All Valkey deployments on the 7.2, 8.0, 8.1, 9.0, and 9.1 branches prior to the fixed releases are affected, but only when TLS is enabled. No public proof-of-concept is known, the flaw is not in CISA's KEV catalog, EPSS estimates roughly a 0.5% chance of exploitation in the next 30 days, and Ubuntu has shipped fixes in USN-8771-1.

What to do: Upgrade Valkey to 7.2.14, 8.0.10, 8.1.9, 9.0.5, or 9.1.1 depending on your branch, and apply Ubuntu's USN-8771-1 update if running the distro package. Until patched, restrict network access to the server, enforce strong authentication/ACLs so only trusted clients can connect, and limit or monitor use of CLIENT KILL, since triggering the bug requires an authenticated client. Verify whether your deployment runs with TLS enabled, as non-TLS instances are not affected.