Threat Intelligence Database

Red Hat has issued an important security advisory for Valkey, an advanced key-value store used in Red Hat Enterprise Linux 10. The advisory addresses multiple remote code execution vulnerabilities, including CVE-2026-56684 and CVE-2026-63639, both involving use-after-free conditions in Valkey's stream deserialization and TLS pending-data processing. The update rebases Valkey to version 8.0.10 and includes bug fixes and enhancements. These vulnerabilities could allow remote attackers to execute arbitrary code. The advisory covers multiple Red Hat Enterprise Linux 10 variants across architectures such as x86_64, s390x, ppc64le, and aarch64. A security update is available to remediate these issues.

Multiple remote code execution vulnerabilities have been identified in Valkey, an advanced key-value store used in Red Hat Enterprise Linux 9. These include use-after-free flaws in stream deserialization and TLS pending-data processing. The vulnerabilities are addressed in an update rebasing Valkey to version 8.0.10. The update is rated as important by Red Hat Product Security.