CVE-2026-63639

Valkey, the Linux Foundation's open-source distributed key-value database and Redis fork, contains a use-after-free (CWE-416) in its processing of the RESTORE command. An authenticated client can supply a malformed RDB stream payload that, during stream consumer-group deserialization, assigns a single Pending Entry List NACK to multiple consumers; when one of those consumers is deleted while another still references the shared NACK, freed memory is reused, which can corrupt the server and potentially allows remote code execution. A successful attacker gains code execution on the Valkey server host with high impact on confidentiality, integrity, and availability (CVSS 3.1 score 8.8, network vector, low privileges required, no user interaction). All deployments running Valkey versions prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, or 9.1.1 are affected, including downstream distribution packages such as Ubuntu's valkey, for which Canonical issued USN-8771-1. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known, and EPSS currently estimates only a 0.9% probability of exploitation within 30 days.

What to do: Upgrade Valkey to version 7.2.14, 8.0.10, 8.1.9, 9.0.5, or 9.1.1 depending on your release branch; Ubuntu users should apply the update from USN-8771-1. Because exploitation requires an authenticated client connection, restrict network access to the Valkey port, enforce authentication/ACLs, and limit which clients can issue RESTORE. Check running instances via the server banner or INFO command to confirm they are on a fixed version.