CVE-2026-56684

Description

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's tlsProcessPendingData function iterates pending_list while an authenticated client can trigger CLIENT KILL, causing connTLSClose to delete the iterator's cached next node and producing a use-after-free that can crash the server or potentially allow remote code execution when TLS is enabled. This issue is fixed in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1.

• How can I get the fixes?
• What do statuses mean?
• Patch details

Get expanded security coverage with Ubuntu Pro

Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.

Patch details

Severity score breakdown

CVSS version: CVSS v3.0

References

• MITRE
• NVD
• Launchpad
• Debian

Related Ubuntu Security Notices (USN)

• USN-8771-1
• Valkey vulnerabilities
• 16 September 2026

Other references

• https://www.cve.org/CVERecord?id=CVE-2026-56684
• https://github.com/valkey-io/valkey/security/advisories/GHSA-53mc-f3m3-99vh
• https://github.com/valkey-io/valkey/pull/4234
• https://github.com/valkey-io/valkey/commit/33b14adf2026cfd8728607b026edb24843805844