AZL-96885

See a problem?

Import Source

https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-96885.json

JSON Data

https://api.osv.dev/v1/vulns/AZL-96885

Upstream

CVE-2026-63639

Published

2026-08-18T15:16:56Z

Modified

2026-08-30T05:26:50Z

Summary

CVE-2026-63639 affecting package valkey for versions less than 8.0.10-1

Details

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when one consumer is deleted while another still references the shared NACK and potentially allowing remote code execution. This issue is fixed in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-63639

Affected packages

Azure Linux:3 / valkey

Package

Name: valkey
Purl: pkg:rpm/azure-linux/valkey

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

8.0.10-1

Database specific

source

"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-96885.json"