HighFix available
redict, valkey — security advisory
Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when one consumer is deleted while another still references the shared NACK and potentially allowing remote code execution. This issue is fixed in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1.
- Products
- redict, valkey
- Affected versions
- 7.3.0+ds-1, 7.3.0+ds-2, 7.3.0+ds-3, 7.3.0+ds-3~bpo12+1, 7.3.1+ds-1, 7.3.2+ds-1, 7.3.2+ds-1~bpo12+1, 7.3.5+ds-1, 7.3.5+ds-1~bpo12+1, 7.3.6+ds-1, 7.3.6+ds-1~bpo12+1, 7.3.6+ds-1~bpo13+1, 7.3.6+ds-2, 7.3.6+ds-2~bpo12+1, 7.3.6+ds-2~bpo13+1, 7.3.6+ds-3, 8.1.1+dfsg1-3, 8.1.1+dfsg1-3+deb13u1, 8.1.1+dfsg1-3+deb13u2, 8.1.4+dfsg1-1, 8.1.4+dfsg1-2
- Fixed versions
- 8.1.1+dfsg1-3+deb13u3, 9.1.1-1
- CVEs
- CVE-2026-63639
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 17:21 UTC · Revision 1
Source evidence
Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when one consumer is deleted while another still references the shared NACK and potentially allowing remote code execution. This issue is fixed in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1.
osv:DEBIAN-CVE-2026-63639
redict
Fixed versions: Not specified
valkey
Fixed versions: 8.1.1+dfsg1-3+deb13u3
valkey
Fixed versions: 9.1.1-1
Complete source record
{
"id": "8b498b9f4c6a1885dcd8ced78170bff05a43a5e87dd411784c1f5b5d280430a8",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2026-63639",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2026-63639",
"summary": "Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when one consumer is deleted while another still references the shared NACK and potentially allowing remote code execution. This issue is fixed in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1.",
"evidence": "osv:DEBIAN-CVE-2026-63639",
"products": [
{
"name": {
"value": "redict",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "7.3.0+ds-1",
"evidence": "/affected/0/versions"
},
{
"value": "7.3.0+ds-2",
"evidence": "/affected/0/versions"
},
{
"value": "7.3.0+ds-3",
"evidence": "/affected/0/versions"
},
{
"value": "7.3.0+ds-3~bpo12+1",
"evidence": "/affected/0/versions"
},
{
"value": "7.3.1+ds-1",
"evidence": "/affected/0/versions"
},
{
"value": "7.3.2+ds-1",
"evidence": "/affected/0/versions"
},
{
"value": "7.3.2+ds-1~bpo12+1",
"evidence": "/affected/0/versions"
},
{
"value": "7.3.5+ds-1",
"evidence": "/affected/0/versions"
},
{
"value": "7.3.5+ds-1~bpo12+1",
"evidence": "/affected/0/versions"
},
{
"value": "7.3.6+ds-1",
"evidence": "/affected/0/versions"
},
{
"value": "7.3.6+ds-1~bpo12+1",
"evidence": "/affected/0/versions"
},
{
"value": "7.3.6+ds-1~bpo13+1",
"evidence": "/affected/0/versions"
},
{
"value": "7.3.6+ds-2",
"evidence": "/affected/0/versions"
},
{
"value": "7.3.6+ds-2~bpo12+1",
"evidence": "/affected/0/versions"
},
{
"value": "7.3.6+ds-2~bpo13+1",
"evidence": "/affected/0/versions"
},
{
"value": "7.3.6+ds-3",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "valkey",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "8.1.1+dfsg1-3+deb13u3",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": [
{
"value": "8.1.1+dfsg1-3",
"evidence": "/affected/1/versions"
},
{
"value": "8.1.1+dfsg1-3+deb13u1",
"evidence": "/affected/1/versions"
},
{
"value": "8.1.1+dfsg1-3+deb13u2",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "valkey",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "9.1.1-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": [
{
"value": "8.1.1+dfsg1-3",
"evidence": "/affected/2/versions"
},
{
"value": "8.1.4+dfsg1-1",
"evidence": "/affected/2/versions"
},
{
"value": "8.1.4+dfsg1-2",
"evidence": "/affected/2/versions"
}
]
}
],
"severity": "high",
"structured": {
"id": "DEBIAN-CVE-2026-63639",
"aliases": [
"DEBIAN-CVE-2026-63639"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "redict",
"purl": "pkg:deb/debian/redict?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"7.3.0+ds-1",
"7.3.0+ds-2",
"7.3.0+ds-3",
"7.3.0+ds-3~bpo12+1",
"7.3.1+ds-1",
"7.3.2+ds-1",
"7.3.2+ds-1~bpo12+1",
"7.3.5+ds-1",
"7.3.5+ds-1~bpo12+1",
"7.3.6+ds-1",
"7.3.6+ds-1~bpo12+1",
"7.3.6+ds-1~bpo13+1",
"7.3.6+ds-2",
"7.3.6+ds-2~bpo12+1",
"7.3.6+ds-2~bpo13+1",
"7.3.6+ds-3"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-63639.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.1.1+dfsg1-3+deb13u3"
}
]
}
],
"package": {
"name": "valkey",
"purl": "pkg:deb/debian/valkey?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"8.1.1+dfsg1-3",
"8.1.1+dfsg1-3+deb13u1",
"8.1.1+dfsg1-3+deb13u2"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-63639.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "9.1.1-1"
}
]
}
],
"package": {
"name": "valkey",
"purl": "pkg:deb/debian/valkey?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"8.1.1+dfsg1-3",
"8.1.4+dfsg1-1",
"8.1.4+dfsg1-2"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-63639.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-27T05:00:08.512097527Z",
"provider": "osv",
"upstream": [
"CVE-2026-63639"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2026-63639"
]
},
"related_cves": [
{
"value": "CVE-2026-63639",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 460345,
"published_at": "2026-08-18T15:16:56.627+00:00"
}