Search: CVE-2026-63639

CVE-2026-63639 is a high-severity use-after-free vulnerability in the valkey distributed key-value database. It affects the RESTORE command prior to versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1. The flaw arises when a malformed RDB stream payload assigns a single Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, leading to a use-after-free condition if one consumer is deleted while others still reference the shared NACK. This can potentially allow remote code execution. The issue is fixed in the specified patched versions.