CVE-2026-56684

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-56684
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-56684.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-56684
Aliases
Downstream
AZL (1)
BELL (1)
DEBIAN (1)
openSUSE (2)
RHSA (4)
RLSA (2)
SUSE (2)
UBUNTU (1)
Related
ALSA (2)
openSUSE (2)
SUSE (2)
Published
2026-08-18T14:19:51Z
Modified
2026-09-20T14:24:17Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Valkey: TLS pending-data processing use-after-free may allow remote code execution
Details

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's tlsProcessPendingData function iterates pending_list while an authenticated client can trigger CLIENT KILL, causing connTLSClose to delete the iterator's cached next node and producing a use-after-free that can crash the server or potentially allow remote code execution when TLS is enabled. This issue is fixed in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-416"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56684.json"
}
References

Affected packages

Git / github.com/valkey-io/valkey

Affected ranges

Type
GIT
Repo
https://github.com/valkey-io/valkey
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Introduced
2b5c7a0dbd61fd4281ef6166b7d119ba7fe7368c
Introduced
67c8683792fc9ab7e295f833478eca180c5e4691
Introduced
5018b12b0de2d2322a1bbf6b041c43740587c0f2
Introduced
c9e8005e9d0ec817e26c7db318861cb821409249
Fixed
499cfb9431c7cebec4d91f81bb4932a742a8c8ae
Fixed
23b3f6bb66c19502225a40e7aeec9e1be76456c1
Fixed
a9245aaf3286dee1795763661f0da6886acd8ef4
Fixed
a253513ac7ff5790ca119053f3c7fbca4fdaad44
Fixed
d27f9ba65a04e80d9c417112a7621fc98a56f70d
Fixed
7cd5bcb7575d750ec2de618db80da58680a10fe3
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "7.2.14"
        },
        {
            "introduced":  "8.0.0"
        },
        {
            "fixed":  "8.0.10"
        },
        {
            "introduced":  "8.1.0"
        },
        {
            "fixed":  "8.1.9"
        },
        {
            "introduced":  "9.0.0"
        },
        {
            "fixed":  "9.0.5"
        },
        {
            "introduced":  "9.1.0"
        },
        {
            "fixed":  "9.1.1"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

7.*
7.2.10
7.2.11
7.2.12
7.2.13
7.2.4
7.2.4-rc1
7.2.5
7.2.5-rc1
7.2.6
7.2.7
7.2.8
7.2.9
8.*
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.9
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.1.5
8.1.6
8.1.7
8.1.8
9.*
9.0.0
9.0.1
9.0.2
9.0.3
9.0.4
9.1
9.1.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-56684.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "257838141374980544053377027307065118074",
            "length":  259
        },
        "id":  "CVE-2026-56684-8065d4c1",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/valkey-io/valkey/commit/7cd5bcb7575d750ec2de618db80da58680a10fe3",
        "target":  {
            "file":  "src/tls.c",
            "function":  "tlsProcessPendingData"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "205603866826886228705287116857940724719",
                "307206345666811994292734997300870204018",
                "45703851843795800979079209927880259665",
                "139938559184774966083587754178468990182",
                "299082083791088557087453839065925009656",
                "162414704591053017749326517923089046738",
                "198071868249015045736900182625827027817",
                "281756496751194748324509474716653118956",
                "126627964511863400972304111509054999908",
                "261016520391421488939166575166843385222"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-56684-8a367d24",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/valkey-io/valkey/commit/7cd5bcb7575d750ec2de618db80da58680a10fe3",
        "target":  {
            "file":  "src/tls.c"
        }
    }
]
vanir_signatures_modified 
"2026-09-20T14:24:17Z"