Valkey is an advanced key-value store supporting various data types and atomic operations, optimized for in-memory datasets with optional persistence and replication features. The Red Hat advisory RHSA-2026:64796 addresses three remote code execution vulnerabilities: CVE-2026-66373 in Redis via a crafted RESTORE payload, CVE-2026-63639 in Valkey due to a use-after-free in stream deserialization, and CVE-2026-56684 in Valkey due to a use-after-free in TLS pending-data processing. These use-after-free vulnerabilities could allow remote attackers to execute arbitrary code on affected systems. The advisory includes a rebase of Valkey to version 8.0.10 and is rated with an important security impact by Red Hat. The update is available for Red Hat Enterprise Linux 10 and its extended update support variants across multiple CPU architectures.

The vulnerabilities allow remote code execution via use-after-free conditions in Valkey's stream deserialization and TLS pending-data processing, potentially enabling attackers to execute arbitrary code remotely. This poses a significant security risk to systems running affected versions of Valkey on Red Hat Enterprise Linux 10. The advisory rates the impact as important, indicating a high severity level but not critical. No known exploits in the wild have been reported at this time.

A security update rebasing Valkey to version 8.0.10 is available from Red Hat to address these vulnerabilities. Users should apply the update promptly to remediate the remote code execution issues. For detailed instructions on applying the update, refer to the Red Hat advisory at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official patch.