Valkey 7.2.14 Security Advisory: Fixes CVE-2026-56684/63639 RCE via TLS Use-After-Free and RDB Issues

Vulnerability Overview Valkey 7.2.14 includes multiple security fixes, primarily addressing Remote Code Execution (RCE) vulnerabilities. Specifically: 1. CVE-2026-56684: A use-after-free vulnerability in TLS connection handling, allowing authenticated clients to achieve remote code execution via . 2. CVE-2026-63639: Rejection of malformed stream RDB files containing shared NACKs across consumers, which could potentially lead to remote code execution. Affected Scope CVE-2026-56684: Affects all Valkey instances that use TLS connection handling and allow operations. CVE-2026-63639: Affects all Valkey instances that process stream RDB files, particularly those containing shared NACKs. Remediation CVE-2026-56684: Fixed the use-after-free vulnerability in TLS connection handling, ensuring no memory errors occur during operations. CVE-2026-63639: Rejects malformed stream RDB files containing shared NACKs to prevent remote code execution. Additional Security Fixes Bug Fixes: - Strictly checks for CRLF when parsing requests, rejecting malformed input as protocol errors. - Fixed memory leaks in and . - Fixed double-free issues when loading stream consumer groups from malformed RDB or RESTORE payloads. - Fixed potential crashes when updating TLS pending data flags via NULL pointer dereference. - Fixed Lua VM crashes that occur when loading functions and executing , ensuring script memory is freed. - Fixed use-after-free issues in client receivers during module unregistration and re-registration. - Fixed file descriptor leaks when blocking connections attempt to timeout. - Fixed crashes caused by NULL keys during , , , and calls. - Fixed invalid memory accesses when loading malformed zipmap payloads. - Rejected zipmap payloads with length field overflows to prevent out-of-bounds accesses on 32-bit platforms. - Rejected NaN scores on sorted sets generated and encoded with zipmaps during RDB payload loading to prevent subsequent server crashes. - Fixed crashes caused by uninitialized memory when registering Lua functions on 64-bit systems. - Fixed stream list corruption and server crashes that occur when marks stream list nodes as deleted. - Fixed an issue where returned subcommands as a RESP3 Set instead of an Array. - Rejected control characters in values and escaped them during configuration rewrites to prevent configuration injection. - Rejected control characters and unsafe delimiters in and to prevent node configuration injection. - Fixed the invalidity of when enabled at startup via configuration file or command line. - Logged actual errors (e.g., ) instead of misleading messages on replication synchronization I/O errors. - Increased the maximum process/thread name length from 255 to 1024 characters to avoid crashes related to long paths. - Fixed an issue where failed when removing unreachable or failed nodes. - Fixed an issue where assigned all unassigned slots to the same master node instead of distributing them randomly. Full Code Block No specific POC code or exploit code is included in the page. Summary Valkey 7.2.14 fixes multiple critical security vulnerabilities, particularly remote code execution vulnerabilities related to TLS connection handling and stream RDB files. It is recommended that users apply this update as soon as possible to ensure system security.

Goal Reached Thanks to every supporter — we hit 100%!

Valkey 7.2.14 Security Advisory: Fixes CVE-2026-56684/63639 RCE via TLS Use-After-Free and RDB Issues

More from this source