CVE-2026-56684

Name of the Vulnerable Software and Affected Versions Valkey versions prior to 7.2.14 Valkey versions prior to 8.0.10 Valkey versions prior to 8.1.9 Valkey versions prior to 9.0.5 Valkey versions prior to 9.1.1

Description A use-after-free issue exists when TLS is enabled. The tlsProcessPendingData() function iterates through the pending list, but an authenticated client can trigger a CLIENT KILL command. This causes connTLSClose() to delete the iterator's cached next node, which can lead to a server crash or potentially allow remote code execution.

Recommendations Update to version 7.2.14 Update to version 8.0.10 Update to version 8.1.9 Update to version 9.0.5 Update to version 9.1.1