CVE-2026-63639

Name of the Vulnerable Software and Affected Versions Valkey versions prior to 7.2.14 Valkey versions prior to 8.0.10 Valkey versions prior to 8.1.9 Valkey versions prior to 9.0.5 Valkey versions prior to 9.1.1

Description The RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization. This leads to a use-after-free condition when one consumer is deleted while another still references the shared NACK, which could potentially allow remote code execution.

Recommendations Update to version 7.2.14 Update to version 8.0.10 Update to version 8.1.9 Update to version 9.0.5 Update to version 9.1.1