CVE-2026-63639

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-63639
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63639.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-63639
Aliases
  • GHSA-mvcj-73cw-22m4
Downstream
Related
Published
2026-08-18T14:23:52.508Z
Modified
2026-08-20T10:17:20.052699Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Valkey: UAF in stream deserialization may lead to remote code execution
Details

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when one consumer is deleted while another still references the shared NACK and potentially allowing remote code execution. This issue is fixed in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-416"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63639.json"
}
References

Affected packages

Git / github.com/valkey-io/valkey

Affected ranges

Type
GIT
Repo
https://github.com/valkey-io/valkey
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Introduced
2b5c7a0dbd61fd4281ef6166b7d119ba7fe7368c
Introduced
67c8683792fc9ab7e295f833478eca180c5e4691
Introduced
5018b12b0de2d2322a1bbf6b041c43740587c0f2
Introduced
c9e8005e9d0ec817e26c7db318861cb821409249
Fixed
499cfb9431c7cebec4d91f81bb4932a742a8c8ae
Fixed
23b3f6bb66c19502225a40e7aeec9e1be76456c1
Fixed
a9245aaf3286dee1795763661f0da6886acd8ef4
Fixed
a253513ac7ff5790ca119053f3c7fbca4fdaad44
Fixed
d27f9ba65a04e80d9c417112a7621fc98a56f70d
Fixed
06bc7768fe609f2054e69ccedefe7628f5675da9
Fixed
509cb3c74e8cbc9c0498ebe8b6c93dcd605e7271
Fixed
98465eaffe3f95524a5046318bfbc4bdb9798291
Fixed
e95911d4d65be8789fa3705f44d7ed1e65378445
Fixed
f8d2027e8d4df790ac04974bf606408c8ea62778
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "7.2.14"
        },
        {
            "introduced": "8.0.0"
        },
        {
            "fixed": "8.0.10"
        },
        {
            "introduced": "8.1.0"
        },
        {
            "fixed": "8.1.9"
        },
        {
            "introduced": "9.0.0"
        },
        {
            "fixed": "9.0.5"
        },
        {
            "introduced": "9.1.0"
        },
        {
            "fixed": "9.1.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

7.*
7.2.10
7.2.11
7.2.12
7.2.13
7.2.4
7.2.4-rc1
7.2.5
7.2.5-rc1
7.2.6
7.2.7
7.2.8
7.2.9
8.*
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.9
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.1.5
8.1.6
8.1.7
8.1.8
9.*
9.0.0
9.0.1
9.0.2
9.0.3
9.0.4
9.1
9.1.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63639.json"
vanir_signatures 
[
    {
        "target": {
            "function": "rdbLoadObject",
            "file": "src/rdb.c"
        },
        "deprecated": false,
        "source": "https://github.com/valkey-io/valkey/commit/e95911d4d65be8789fa3705f44d7ed1e65378445",
        "id": "CVE-2026-63639-00f94091",
        "signature_version": "v1",
        "digest": {
            "length": 23591.0,
            "function_hash": "230768877839611101054266632653368496"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "function": "rdbLoadObject",
            "file": "src/rdb.c"
        },
        "deprecated": false,
        "source": "https://github.com/valkey-io/valkey/commit/509cb3c74e8cbc9c0498ebe8b6c93dcd605e7271",
        "id": "CVE-2026-63639-55fc876e",
        "signature_version": "v1",
        "digest": {
            "length": 25013.0,
            "function_hash": "190544403724282786927446598291365725110"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "file": "src/rdb.c"
        },
        "deprecated": false,
        "source": "https://github.com/valkey-io/valkey/commit/06bc7768fe609f2054e69ccedefe7628f5675da9",
        "id": "CVE-2026-63639-74e1321c",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "244415621463808803534515582580094818674",
                "250433548265456674924563231111053879241",
                "154392023832950776650256860880923554603"
            ]
        },
        "signature_type": "Line"
    },
    {
        "target": {
            "file": "src/rdb.c"
        },
        "deprecated": false,
        "source": "https://github.com/valkey-io/valkey/commit/98465eaffe3f95524a5046318bfbc4bdb9798291",
        "id": "CVE-2026-63639-7a410202",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "244415621463808803534515582580094818674",
                "250433548265456674924563231111053879241",
                "154392023832950776650256860880923554603"
            ]
        },
        "signature_type": "Line"
    },
    {
        "target": {
            "function": "rdbLoadObject",
            "file": "src/rdb.c"
        },
        "deprecated": false,
        "source": "https://github.com/valkey-io/valkey/commit/f8d2027e8d4df790ac04974bf606408c8ea62778",
        "id": "CVE-2026-63639-7d8ae8dc",
        "signature_version": "v1",
        "digest": {
            "length": 23619.0,
            "function_hash": "287353720323192030297397996837231637699"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "function": "rdbLoadObject",
            "file": "src/rdb.c"
        },
        "deprecated": false,
        "source": "https://github.com/valkey-io/valkey/commit/98465eaffe3f95524a5046318bfbc4bdb9798291",
        "id": "CVE-2026-63639-9124e9c8",
        "signature_version": "v1",
        "digest": {
            "length": 23584.0,
            "function_hash": "212916778563393476109431128336851754874"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "function": "rdbLoadObject",
            "file": "src/rdb.c"
        },
        "deprecated": false,
        "source": "https://github.com/valkey-io/valkey/commit/06bc7768fe609f2054e69ccedefe7628f5675da9",
        "id": "CVE-2026-63639-c101b93f",
        "signature_version": "v1",
        "digest": {
            "length": 24119.0,
            "function_hash": "131976171611182190110098626164708744336"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "file": "src/rdb.c"
        },
        "deprecated": false,
        "source": "https://github.com/valkey-io/valkey/commit/f8d2027e8d4df790ac04974bf606408c8ea62778",
        "id": "CVE-2026-63639-efbc0c10",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "244415621463808803534515582580094818674",
                "250433548265456674924563231111053879241",
                "154392023832950776650256860880923554603"
            ]
        },
        "signature_type": "Line"
    },
    {
        "target": {
            "file": "src/rdb.c"
        },
        "deprecated": false,
        "source": "https://github.com/valkey-io/valkey/commit/509cb3c74e8cbc9c0498ebe8b6c93dcd605e7271",
        "id": "CVE-2026-63639-fe4820c0",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "244415621463808803534515582580094818674",
                "250433548265456674924563231111053879241",
                "154392023832950776650256860880923554603"
            ]
        },
        "signature_type": "Line"
    }
]
vanir_signatures_modified 
"2026-08-20T10:17:20Z"