Red Hat Security Advisory

RHSA-2026:68601

valkey security update

Released 2026-09-17 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream EUS (v. 10.0) valkey-8.0.11-1.el10_0, valkey-devel-8.0.11-1.el10_0

Fixes 3 records

TI-2026-47139 CVE-2026-66373 · GHSA-c964-568j-vxx7

Double free in Redis

HIGH 68

Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer,…

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00872 Published 2026-07-25 Fixed in 8.8.0 CWE-415

TI-2026-45281 CVE-2026-63639

Valkey: UAF in stream deserialization may lead to remote code execution

MEDIUM 42

Valkey is a distributed key-value database.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00888 Published 2026-08-18 Fixed in 7.2.14, 8.0.10 +3 CWE-416

TI-2026-40865 CVE-2026-56684

Valkey: TLS pending-data processing use-after-free may allow remote code execution

LOW 35

Valkey is a distributed key-value database.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00523 Published 2026-08-18 Fixed in 7.2.14, 8.0.10 +3 CWE-416