Valkey TLS UAF via CLIENT KILL in <7.2.14/8.0.10/8.1.9/9.0.5/9.1.1
CVE-2026-56684 Published on August 18, 2026
Valkey: TLS pending-data processing use-after-free may allow remote code execution
Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's tlsProcessPendingData function iterates pending_list while an authenticated client can trigger CLIENT KILL, causing connTLSClose to delete the iterator's cached next node and producing a use-after-free that can crash the server or potentially allow remote code execution when TLS is enabled. This issue is fixed in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1.
Vulnerability Analysis
CVE-2026-56684 is exploitable with network access, and requires small amount of user privileges. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.
Weakness Type
What is a Dangling pointer Vulnerability?
Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.
CVE-2026-56684 has been classified to as a Dangling pointer vulnerability or weakness.
Products Associated with CVE-2026-56684
Want to know whenever a new CVE is published for Canonical Ubuntu Linux? stack.watch will email you.
Affected Versions
valkey-io valkey:- Version < 7.2.14 is affected.
- Version >= 8.0.0, < 8.0.10 is affected.
- Version >= 8.1.0, < 8.1.9 is affected.
- Version >= 9.0.0, < 9.0.5 is affected.
- Version >= 9.1.0, < 9.1.1 is affected.