USN-8771-1: Valkey vulnerabilities
Ubuntu issued USN-8771-1 fixing Valkey flaws (CVE-2026-56684, CVE-2026-63639) that allow denial of service or possible code execution.
Ubuntu Security Notice USN-8771-1 patches multiple vulnerabilities in Valkey, the Redis-compatible in-memory data store. CVE-2026-56684, discovered by Madelyn Olson, involves incorrect TLS connection handling that a remote attacker could trigger to crash Valkey or possibly execute arbitrary code. CVE-2026-63639 involves incorrect handling of stream RDB payloads via the RESTORE command, exploitable by an authenticated remote attacker for denial of service or possible code execution. A third flaw in cluster slot migration operations also allows remote attackers to crash the service.
- CVE-2026-56684: malformed TLS connection handling can crash Valkey or possibly allow code execution
- CVE-2026-63639: authenticated attackers can abuse RESTORE with crafted stream RDB payloads
- Cluster slot migration flaw enables remote denial-of-service attacks
- Fixes delivered through Ubuntu Security Notice USN-8771-1
- Products
- Valkey
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-63639+1 related CVE | Use-after-free in Valkey RESTORE command may allow remote code execution | 8.8 group max | <1% |
From the original article
Madelyn Olson discovered that Valkey incorrectly handled TLS connections under certain conditions. A remote attacker could possibly use this issue to cause Valkey to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-56684) It was discovered that Valkey incorrectly handled certain stream RDB payloads when executing the RESTORE command.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.