Use-after-free in Valkey - CVE-2026-56684

Vulnerability identifier: #VU139070

CSH Severity: Medium

CVSS v4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-56684

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the TLS connection handling. A remote user can execute arbitrary code on the target system.

Valkey
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Real Time 15
Fedora
Server Applications Module
openSUSE Leap
valkey
valkey-debugsource
valkey-devel
valkey-debuginfo
valkey-compat-redis

Install updates from vendor's website.

Valkey - addressed in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, 9.1.1
valkey - addressed in versions 8.0.10-1.el8, 8.1.9-1.fc43, 9.0.5-1.fc44
valkey-debugsource - addressed in versions 8.0.10-150600.13.28.1, 8.0.10-150700.3.20.1
valkey-devel - addressed in versions 8.0.10-150600.13.28.1, 8.0.10-150700.3.20.1
valkey-debuginfo - addressed in versions 8.0.10-150600.13.28.1, 8.0.10-150700.3.20.1
valkey - addressed in versions 8.0.10-150600.13.28.1, 8.0.10-150700.3.20.1
valkey-compat-redis - addressed in versions 8.0.10-150600.13.28.1, 8.0.10-150700.3.20.1

• https://github.com/valkey-io/valkey/security/advisories/GHSA-53mc-f3m3-99vh

• Multiple vulnerabilities in Valkey
• Fedora EPEL 8 update for valkey
• Fedora 43 update for valkey
• Fedora 44 update for valkey
• SUSE update for valkey
• SUSE update for valkey