{"id":"CVE-2026-63639","summary":"Valkey: UAF in stream deserialization may lead to remote code execution","details":"Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when one consumer is deleted while another still references the shared NACK and potentially allowing remote code execution. This issue is fixed in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1.","aliases":["BIT-valkey-2026-63639","GHSA-mvcj-73cw-22m4"],"modified":"2026-10-21T02:58:56.579250645Z","published":"2026-08-18T14:23:52.508Z","related":["ALSA-2026:64796","ALSA-2026:64807","SUSE-SU-2026:3427-1","SUSE-SU-2026:3483-1","openSUSE-SU-2026:11381-1","openSUSE-SU-2026:21485-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63639.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-416"]},"references":[{"type":"WEB","url":"https://github.com/valkey-io/valkey/releases/tag/7.2.14"},{"type":"WEB","url":"https://github.com/valkey-io/valkey/releases/tag/8.0.10"},{"type":"WEB","url":"https://github.com/valkey-io/valkey/releases/tag/8.1.9"},{"type":"WEB","url":"https://github.com/valkey-io/valkey/releases/tag/9.0.5"},{"type":"WEB","url":"https://github.com/valkey-io/valkey/releases/tag/9.1.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63639.json"},{"type":"ADVISORY","url":"https://github.com/valkey-io/valkey/security/advisories/GHSA-mvcj-73cw-22m4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63639"},{"type":"FIX","url":"https://github.com/valkey-io/valkey/commit/06bc7768fe609f2054e69ccedefe7628f5675da9"},{"type":"FIX","url":"https://github.com/valkey-io/valkey/commit/509cb3c74e8cbc9c0498ebe8b6c93dcd605e7271"},{"type":"FIX","url":"https://github.com/valkey-io/valkey/commit/98465eaffe3f95524a5046318bfbc4bdb9798291"},{"type":"FIX","url":"https://github.com/valkey-io/valkey/commit/e95911d4d65be8789fa3705f44d7ed1e65378445"},{"type":"FIX","url":"https://github.com/valkey-io/valkey/commit/f8d2027e8d4df790ac04974bf606408c8ea62778"},{"type":"FIX","url":"https://github.com/valkey-io/valkey/pull/4073"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/valkey-io/valkey","events":[{"introduced":"0"},{"fixed":"499cfb9431c7cebec4d91f81bb4932a742a8c8ae"},{"introduced":"2b5c7a0dbd61fd4281ef6166b7d119ba7fe7368c"},{"fixed":"23b3f6bb66c19502225a40e7aeec9e1be76456c1"},{"introduced":"67c8683792fc9ab7e295f833478eca180c5e4691"},{"fixed":"a9245aaf3286dee1795763661f0da6886acd8ef4"},{"introduced":"5018b12b0de2d2322a1bbf6b041c43740587c0f2"},{"fixed":"a253513ac7ff5790ca119053f3c7fbca4fdaad44"},{"introduced":"c9e8005e9d0ec817e26c7db318861cb821409249"},{"fixed":"d27f9ba65a04e80d9c417112a7621fc98a56f70d"},{"fixed":"06bc7768fe609f2054e69ccedefe7628f5675da9"},{"fixed":"509cb3c74e8cbc9c0498ebe8b6c93dcd605e7271"},{"fixed":"98465eaffe3f95524a5046318bfbc4bdb9798291"},{"fixed":"e95911d4d65be8789fa3705f44d7ed1e65378445"},{"fixed":"f8d2027e8d4df790ac04974bf606408c8ea62778"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"0"},{"fixed":"7.2.14"}],"source":"AFFECTED_FIELD","strategy":"StringRangeExpression"},{"source":"AFFECTED_FIELD","strategy":"StringRangeExpression","range":[{"introduced":"8.0.0"},{"fixed":"8.0.10"}]},{"source":"AFFECTED_FIELD","strategy":"StringRangeExpression","range":[{"introduced":"8.1.0"},{"fixed":"8.1.9"}]},{"strategy":"StringRangeExpression","range":[{"introduced":"9.0.0"},{"fixed":"9.0.5"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"9.1.0"},{"fixed":"9.1.1"}],"source":"AFFECTED_FIELD","strategy":"StringRangeExpression"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"06bc7768fe609f2054e69ccedefe7628f5675da9"}]},{"range":[{"fixed":"509cb3c74e8cbc9c0498ebe8b6c93dcd605e7271"}],"source":"REFERENCES_COMMIT"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"98465eaffe3f95524a5046318bfbc4bdb9798291"}]},{"range":[{"fixed":"e95911d4d65be8789fa3705f44d7ed1e65378445"}],"source":"REFERENCES_COMMIT"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"f8d2027e8d4df790ac04974bf606408c8ea62778"}]},{"source":"REFERENCES_TAG","original_tag":"7.2.14","range":[{"fixed":"499cfb9431c7cebec4d91f81bb4932a742a8c8ae"}]},{"source":"REFERENCES_TAG","original_tag":"8.0.10","range":[{"fixed":"23b3f6bb66c19502225a40e7aeec9e1be76456c1"}]},{"original_tag":"8.1.9","range":[{"fixed":"a9245aaf3286dee1795763661f0da6886acd8ef4"}],"source":"REFERENCES_TAG"},{"original_tag":"9.0.5","range":[{"fixed":"a253513ac7ff5790ca119053f3c7fbca4fdaad44"}],"source":"REFERENCES_TAG"},{"original_tag":"9.1.1","range":[{"fixed":"d27f9ba65a04e80d9c417112a7621fc98a56f70d"}],"source":"REFERENCES_TAG"}]}}],"versions":["9.1.0","9.1","9.0.4","8.1.8","8.0.9","8.1.7","7.2.13","8.0.7","8.1.6","9.0.3","7.2.12","9.0.2","8.1.5","9.0.1","9.0.0","7.2.11","8.0.6","8.1.4","7.2.10","8.0.5","8.0.4","8.1.3","8.0.3","8.1.2","7.2.9","8.1.1","8.1.0","7.2.8","8.0.2","7.2.7","8.0.1","8.0.0","7.2.6","7.2.5","7.2.5-rc1","7.2.4-rc1","7.2.4"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63639.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}