Valkey 8.1.9 Advisory: Fixes TLS RCE via use-after-free and RDB deserialization RCE (CVE-2026-56684, CVE-2026-63639)

Vulnerability Overview Valkey version 8.1.9, released on July 21, 2026, contains multiple security fixes. The primary vulnerabilities include: 1. CVE-2026-56684: A use-after-free vulnerability in the TLS connection handling process, allowing authenticated clients to achieve remote code execution via the command. 2. CVE-2026-63639: Rejection of corrupted stream RDB files containing cross-consumer shared NACKs, which may lead to remote code execution. Affected Scope CVE-2026-56684: Affects all Valkey instances that process TLS connections, particularly those systems that allow authenticated clients to execute the command. CVE-2026-63639: Affects all Valkey instances that process stream RDB files, particularly those systems that may contain corrupted files. Remediation CVE-2026-56684: Upgrade to Valkey version 8.1.9, which has fixed this vulnerability. CVE-2026-63639: Upgrade to Valkey version 8.1.9, which has fixed this vulnerability. POC Code or Exploit Code No specific POC code or exploit code was provided on the page. Additional Information Release Date: July 21, 2026 Contributors: sarthakaggarwal97, enjoy-binbin, juleslasarte, madolson, chenshi5012, trickrams, eltrah-aws, pkharts, and 7 other contributors. Full Changelog: 8.1.8...8.1.9 Assets Source Code (zip): Download Link Source Code (tar.gz): Download Link Summary Valkey version 8.1.9 fixes two critical security vulnerabilities. All users are advised to upgrade to this version as soon as possible to ensure system security.

Goal Reached Thanks to every supporter — we hit 100%!

Valkey 8.1.9 Advisory: Fixes TLS RCE via use-after-free and RDB deserialization RCE (CVE-2026-56684, CVE-2026-63639)

More from this source