Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2026-56684: Valkey is a distributed key-value database

41
This month
HIGH 7.5

CVE-2026-56684 is a high-severity flaw (CVSS 7.5) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's tlsProcessPendingData function iterates pending_list while an authenticated client can trigger CLIENT KILL, causing connTLSClose to delete the iterator's cached next node and producing a use-after-free that can crash the server or potentially allow remote code execution when TLS is enabled. This issue is fixed in versions 7.2.14, 8.0.10, 8.1.9,

Why this priority

  • High severity

A fixed release or distro patch exists.

Risk facts

CVSS score7.5 (High)
Attack vectorNetwork (remote)
Attack complexityHigh
Privileges neededLow
User interactionNone
EPSS exploit chance0.9% (top 41%)
CISA exploited listNo
WeaknessCWE-416
Published2026-08-18
Last modified2026-10-22
Publisher (CNA): GitHub, Inc.

Timeline

Exact fixes by distribution

Fedora 46 · kwin-zones · FIXED · 1.0.13-1.fc46 · FEDORA-2026-95888f332b · source
sudo dnf upgrade --advisory=FEDORA-2026-95888f332b
Fedora ELN · nginx-mod-brotli · FIXED · 1.0.0~rc-16.eln159 · FEDORA-2026-501a6a8273 · source
sudo dnf upgrade --advisory=FEDORA-2026-501a6a8273
Ubuntu 24.04 · valkey · FIXED · 7.2.13+dfsg1-0ubuntu0.1+esm1
sudo apt update && sudo apt install --only-upgrade valkey dpkg --compare-versions "$(dpkg-query -W -f='${Version}' valkey)" ge "7.2.13+dfsg1-0ubuntu0.1+esm1" && echo PATCHED || echo STILL-VULNERABLE
Debian 13 · valkey · NO FIX YET
RHEL 10 · valkey · FIXED · valkey-8.0.11-1.el10_2
sudo dnf upgrade --advisory=RHSA-2026:64796 rpm -q valkey
RHEL 10.0 Extended Update Support · valkey · FIXED · valkey-8.0.11-1.el10_0
sudo dnf upgrade --advisory=RHSA-2026:68601 rpm -q valkey
RHEL 9 · valkey · FIXED · valkey-8.0.10-1.el9_8
sudo dnf upgrade --advisory=RHSA-2026:64807 rpm -q valkey
Amazon Linux 2023 · see advisory · FIXED · ALAS2023-2026-2011 · source
sudo dnf update --advisory=ALAS2023-2026-2011
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-56684?

No fixed release is listed yet. Watch the vendor advisory and apply any mitigation shown on this page.

Is CVE-2026-56684 being exploited?

CVE-2026-56684 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2026-56684 affect?

CVE-2026-56684 affects affected software. Severity is high (CVSS 7.5). Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's tlsProcessPendingData function iterates pending_list while an authenticated client can trigger CLIENT KILL, causing connTLSClose to delet

How urgent is CVE-2026-56684?

Priority 41/100. High severity

References

← Back to latest CVEs