PatchTheCVECVE-2026-63639: Valkey is a distributed key-value database
48
This month
HIGH 8.8
CVE-2026-63639 is a high-severity flaw (CVSS 8.8) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when one consumer is deleted while another still references the shared NACK and potentially allowing remote code execution. This issue is fixed in versions 7.
Why this priority
- High severity
A fixed release or distro patch exists.
Risk facts
| CVSS score | 8.8 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 1.2% (top 33%) |
| CISA exploited list | No |
| Weakness | CWE-416 |
| Published | 2026-08-18 |
| Last modified | 2026-10-22 |
Publisher (CNA): GitHub, Inc.
Timeline
- Published CVE record published
- Updated Record last modified
Exact fixes by distribution
Fedora 46 · python-trimesh · FIXED · 5.2.0-1.fc46 · FEDORA-2026-429b4bad4c · source
sudo dnf upgrade --advisory=FEDORA-2026-429b4bad4c
Ubuntu 24.04 · valkey · FIXED · 7.2.13+dfsg1-0ubuntu0.1+esm1
sudo apt update && sudo apt install --only-upgrade valkey
dpkg --compare-versions "$(dpkg-query -W -f='${Version}' valkey)" ge "7.2.13+dfsg1-0ubuntu0.1+esm1" && echo PATCHED || echo STILL-VULNERABLE
Debian 13 · valkey · NO FIX YET
RHEL 10 · valkey · FIXED · valkey-8.0.11-1.el10_2
sudo dnf upgrade --advisory=RHSA-2026:64796
rpm -q valkey
RHEL 10.0 Extended Update Support · valkey · FIXED · valkey-8.0.11-1.el10_0
sudo dnf upgrade --advisory=RHSA-2026:68601
rpm -q valkey
RHEL 9 · valkey · FIXED · valkey-8.0.10-1.el9_8
sudo dnf upgrade --advisory=RHSA-2026:64807
rpm -q valkey
sudo dnf update --advisory=ALAS2023-2026-2011
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.