CVE-2026-63639

{
  "id": "CVE-2026-63639",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-18T15:16:56.627",
  "lastModified": "2026-10-22T22:10:00.250",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when one consumer is deleted while another still references the shared NACK and potentially allowing remote code execution. This issue is fixed in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1."
    },
    {
      "lang": "es",
      "value": "Valkey es una base de datos distribuida de clave-valor. Antes de las versiones 7.2.14, 8.0.10, 8.1.9, 9.0.5 y 9.1.1, el comando RESTORE de Valkey acepta una carga útil de flujo RDB malformada que asigna un NACK de lista de entradas pendientes a múltiples consumidores durante la deserialización del grupo de consumidores de flujo, causando un uso después de liberación cuando un consumidor es eliminado mientras otro sigue referenciando el NACK compartido y potencialmente permitiendo la ejecución remota de código. Este problema está solucionado en las versiones 7.2.14, 8.0.10, 8.1.9, 9.0.5 y 9.1.1."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "valkey-io",
          "product": "valkey",
          "versions": [
            {
              "version": "< 7.2.14",
              "status": "affected"
            },
            {
              "version": ">= 8.0.0, < 8.0.10",
              "status": "affected"
            },
            {
              "version": ">= 8.1.0, < 8.1.9",
              "status": "affected"
            },
            {
              "version": ">= 9.0.0, < 9.0.5",
              "status": "affected"
            },
            {
              "version": ">= 9.1.0, < 9.1.1",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-19T03:56:16.213417Z",
          "id": "CVE-2026-63639",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-416"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/valkey-io/valkey/commit/06bc7768fe609f2054e69ccedefe7628f5675da9",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/valkey-io/valkey/commit/509cb3c74e8cbc9c0498ebe8b6c93dcd605e7271",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/valkey-io/valkey/commit/98465eaffe3f95524a5046318bfbc4bdb9798291",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/valkey-io/valkey/commit/e95911d4d65be8789fa3705f44d7ed1e65378445",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/valkey-io/valkey/commit/f8d2027e8d4df790ac04974bf606408c8ea62778",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/valkey-io/valkey/pull/4073",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/valkey-io/valkey/releases/tag/7.2.14",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/valkey-io/valkey/releases/tag/8.0.10",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/valkey-io/valkey/releases/tag/8.1.9",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/valkey-io/valkey/releases/tag/9.0.5",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/valkey-io/valkey/releases/tag/9.1.1",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/valkey-io/valkey/security/advisories/GHSA-mvcj-73cw-22m4",
      "source": "[email protected]"
    }
  ]
}