Use-after-free in Valkey - CVE-2026-63639

Vulnerability identifier: #VU139071

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-63639

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in stream deserialization. A remote user can use a specially crafted RESTORE command and execute arbitrary code on the target system.

Valkey
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Real Time 15
Fedora
Server Applications Module
openSUSE Leap
valkey
valkey-debugsource
valkey-devel
valkey-debuginfo
valkey-compat-redis

Install updates from vendor's website.

Valkey - addressed in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, 9.1.1
valkey - addressed in versions 8.0.10-1.el8, 8.1.9-1.fc43, 9.0.5-1.fc44
valkey-debugsource - addressed in versions 8.0.10-150600.13.28.1, 8.0.10-150700.3.20.1
valkey-devel - addressed in versions 8.0.10-150600.13.28.1, 8.0.10-150700.3.20.1
valkey-debuginfo - addressed in versions 8.0.10-150600.13.28.1, 8.0.10-150700.3.20.1
valkey - addressed in versions 8.0.10-150600.13.28.1, 8.0.10-150700.3.20.1
valkey-compat-redis - addressed in versions 8.0.10-150600.13.28.1, 8.0.10-150700.3.20.1

• https://github.com/valkey-io/valkey/security/advisories/GHSA-mvcj-73cw-22m4

• Multiple vulnerabilities in Valkey
• Fedora EPEL 8 update for valkey
• Fedora 43 update for valkey
• Fedora 44 update for valkey
• SUSE update for valkey
• SUSE update for valkey