CVE-2026-63639
- Source
- https://cve.org/CVERecord?id=CVE-2026-63639
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63639.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-63639
- Aliases
-
- BIT-valkey-2026-63639
- GHSA-mvcj-73cw-22m4
- Downstream
ALPINE (1)
ALSA (2)
AZL (1)
BELL (1)
DEBIAN (1)
openSUSE (2)
RLSA (2)
UBUNTU (1)
- Related
- Published
- 2026-08-18T14:23:52Z
- Modified
- 2026-10-28T10:55:08Z
- Severity
-
- 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- Valkey: UAF in stream deserialization may lead to remote code execution
- Details
-
Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when one consumer is deleted while another still references the shared NACK and potentially allowing remote code execution. This issue is fixed in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-416" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63639.json" }- References
-
- https://github.com/valkey-io/valkey/releases/tag/7.2.14
- https://github.com/valkey-io/valkey/releases/tag/8.0.10
- https://github.com/valkey-io/valkey/releases/tag/8.1.9
- https://github.com/valkey-io/valkey/releases/tag/9.0.5
- https://github.com/valkey-io/valkey/releases/tag/9.1.1
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63639.json
- https://github.com/valkey-io/valkey/security/advisories/GHSA-mvcj-73cw-22m4
- https://nvd.nist.gov/vuln/detail/CVE-2026-63639
- https://github.com/valkey-io/valkey/commit/06bc7768fe609f2054e69ccedefe7628f5675da9
- https://github.com/valkey-io/valkey/commit/509cb3c74e8cbc9c0498ebe8b6c93dcd605e7271
- https://github.com/valkey-io/valkey/commit/98465eaffe3f95524a5046318bfbc4bdb9798291
- https://github.com/valkey-io/valkey/commit/e95911d4d65be8789fa3705f44d7ed1e65378445
- https://github.com/valkey-io/valkey/commit/f8d2027e8d4df790ac04974bf606408c8ea62778
- https://github.com/valkey-io/valkey/pull/4073
Affected packages
Git / github.com/valkey-io/valkey
Affected ranges
- Type
- GIT
- Repo
- https://github.com/valkey-io/valkey
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedFixedFixedFixedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "0" }, { "fixed": "7.2.14" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "introduced": "8.0.0" }, { "fixed": "8.0.10" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "introduced": "8.1.0" }, { "fixed": "8.1.9" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "introduced": "9.0.0" }, { "fixed": "9.0.5" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "introduced": "9.1.0" }, { "fixed": "9.1.1" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "fixed": "06bc7768fe609f2054e69ccedefe7628f5675da9" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "509cb3c74e8cbc9c0498ebe8b6c93dcd605e7271" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "98465eaffe3f95524a5046318bfbc4bdb9798291" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "e95911d4d65be8789fa3705f44d7ed1e65378445" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "f8d2027e8d4df790ac04974bf606408c8ea62778" } ], "source": "REFERENCES_COMMIT" }, { "original_tag": "7.2.14", "range": [ { "fixed": "499cfb9431c7cebec4d91f81bb4932a742a8c8ae" } ], "source": "REFERENCES_TAG" }, { "original_tag": "8.0.10", "range": [ { "fixed": "23b3f6bb66c19502225a40e7aeec9e1be76456c1" } ], "source": "REFERENCES_TAG" }, { "original_tag": "8.1.9", "range": [ { "fixed": "a9245aaf3286dee1795763661f0da6886acd8ef4" } ], "source": "REFERENCES_TAG" }, { "original_tag": "9.0.5", "range": [ { "fixed": "a253513ac7ff5790ca119053f3c7fbca4fdaad44" } ], "source": "REFERENCES_TAG" }, { "original_tag": "9.1.1", "range": [ { "fixed": "d27f9ba65a04e80d9c417112a7621fc98a56f70d" } ], "source": "REFERENCES_TAG" } ] }
Affected versions
7.*
7.2.10
7.2.11
7.2.12
7.2.13
7.2.4
7.2.4-rc1
7.2.5
7.2.5-rc1
7.2.6
7.2.7
7.2.8
7.2.9
8.*
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.9
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.1.5
8.1.6
8.1.7
8.1.8
9.*
9.0.0
9.0.1
9.0.2
9.0.3
9.0.4
9.1
9.1.0
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63639.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "230768877839611101054266632653368496",
"length": 23591
},
"id": "CVE-2026-63639-00f94091",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/valkey-io/valkey/commit/e95911d4d65be8789fa3705f44d7ed1e65378445",
"target": {
"file": "src/rdb.c",
"function": "rdbLoadObject"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "190544403724282786927446598291365725110",
"length": 25013
},
"id": "CVE-2026-63639-55fc876e",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/valkey-io/valkey/commit/509cb3c74e8cbc9c0498ebe8b6c93dcd605e7271",
"target": {
"file": "src/rdb.c",
"function": "rdbLoadObject"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"244415621463808803534515582580094818674",
"250433548265456674924563231111053879241",
"154392023832950776650256860880923554603"
],
"threshold": 0.9
},
"id": "CVE-2026-63639-74e1321c",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/valkey-io/valkey/commit/06bc7768fe609f2054e69ccedefe7628f5675da9",
"target": {
"file": "src/rdb.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"244415621463808803534515582580094818674",
"250433548265456674924563231111053879241",
"154392023832950776650256860880923554603"
],
"threshold": 0.9
},
"id": "CVE-2026-63639-7a410202",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/valkey-io/valkey/commit/98465eaffe3f95524a5046318bfbc4bdb9798291",
"target": {
"file": "src/rdb.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "287353720323192030297397996837231637699",
"length": 23619
},
"id": "CVE-2026-63639-7d8ae8dc",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/valkey-io/valkey/commit/f8d2027e8d4df790ac04974bf606408c8ea62778",
"target": {
"file": "src/rdb.c",
"function": "rdbLoadObject"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "212916778563393476109431128336851754874",
"length": 23584
},
"id": "CVE-2026-63639-9124e9c8",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/valkey-io/valkey/commit/98465eaffe3f95524a5046318bfbc4bdb9798291",
"target": {
"file": "src/rdb.c",
"function": "rdbLoadObject"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "131976171611182190110098626164708744336",
"length": 24119
},
"id": "CVE-2026-63639-c101b93f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/valkey-io/valkey/commit/06bc7768fe609f2054e69ccedefe7628f5675da9",
"target": {
"file": "src/rdb.c",
"function": "rdbLoadObject"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"244415621463808803534515582580094818674",
"250433548265456674924563231111053879241",
"154392023832950776650256860880923554603"
],
"threshold": 0.9
},
"id": "CVE-2026-63639-efbc0c10",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/valkey-io/valkey/commit/f8d2027e8d4df790ac04974bf606408c8ea62778",
"target": {
"file": "src/rdb.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"244415621463808803534515582580094818674",
"250433548265456674924563231111053879241",
"154392023832950776650256860880923554603"
],
"threshold": 0.9
},
"id": "CVE-2026-63639-fe4820c0",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/valkey-io/valkey/commit/509cb3c74e8cbc9c0498ebe8b6c93dcd605e7271",
"target": {
"file": "src/rdb.c"
}
}
]
vanir_signatures_modified
"2026-10-28T10:55:08Z"