Red Hat Security Advisory: valkey security, bug fix, and enhancement update
Multiple remote code execution vulnerabilities have been identified in Valkey, an advanced key-value store used in Red Hat Enterprise Linux 9. These include use-after-free flaws in stream deserialization and TLS pending-data processing. The vulnerabilities are addressed in an update rebasing Valkey to version 8.0.10. The update is rated as important by Red Hat Product Security.
AI Analysis
Technical Summary
Valkey, a high-performance in-memory key-value store supporting various data structures and atomic operations, has multiple security issues leading to remote code execution. Specifically, CVE-2026-56684 involves a use-after-free vulnerability during TLS pending-data processing, and CVE-2026-63639 involves a use-after-free in stream deserialization. Additionally, CVE-2026-66373 affects Redis via a specially crafted RESTORE payload. Red Hat has issued an advisory (RHSA-2026:64807) providing an update that rebases Valkey to version 8.0.10, which includes fixes for these vulnerabilities.
Potential Impact
Successful exploitation of these vulnerabilities could allow remote attackers to execute arbitrary code on affected systems running Valkey. This poses a significant security risk, potentially compromising system integrity and confidentiality. The advisory rates the impact as important, indicating a high severity level.
Mitigation Recommendations
Red Hat has released an update rebasing Valkey to version 8.0.10 that addresses these remote code execution vulnerabilities. Users should apply this update promptly to remediate the issues. For detailed update instructions, refer to the Red Hat advisory at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official patch.
Red Hat Security Advisory: valkey security, bug fix, and enhancement update
Description
Multiple remote code execution vulnerabilities have been identified in Valkey, an advanced key-value store used in Red Hat Enterprise Linux 9. These include use-after-free flaws in stream deserialization and TLS pending-data processing. The vulnerabilities are addressed in an update rebasing Valkey to version 8.0.10. The update is rated as important by Red Hat Product Security.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Valkey, a high-performance in-memory key-value store supporting various data structures and atomic operations, has multiple security issues leading to remote code execution. Specifically, CVE-2026-56684 involves a use-after-free vulnerability during TLS pending-data processing, and CVE-2026-63639 involves a use-after-free in stream deserialization. Additionally, CVE-2026-66373 affects Redis via a specially crafted RESTORE payload. Red Hat has issued an advisory (RHSA-2026:64807) providing an update that rebases Valkey to version 8.0.10, which includes fixes for these vulnerabilities.
Potential Impact
Successful exploitation of these vulnerabilities could allow remote attackers to execute arbitrary code on affected systems running Valkey. This poses a significant security risk, potentially compromising system integrity and confidentiality. The advisory rates the impact as important, indicating a high severity level.
Mitigation Recommendations
Red Hat has released an update rebasing Valkey to version 8.0.10 that addresses these remote code execution vulnerabilities. Users should apply this update promptly to remediate the issues. For detailed update instructions, refer to the Red Hat advisory at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official patch.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:64807
- Cve Count
- 3
- Additional Cves
- ["CVE-2026-63639","CVE-2026-66373"]
- Cvss Version
- null
Threat ID: 6aa005a7acd9273b49ab4576
Added to database: 09/08/2026, 12:55:03 UTC
Last enriched: 09/08/2026, 12:57:09 UTC
Last updated: 09/08/2026, 22:52:13 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.