Valkey-io Valkey vulnerabilities

• valkey-io valkey valkey-io valkey kvstore.c kvstoreGetHashtable out-of-bounds CVE-2026-86227 Fix available 2.3 LowSeptember 6, 2026
• valkey-io valkey valkey-io valkey Slot Migration cluster_migrateslots.c createSlotImportJob out-of-bounds CVE-2026-85522 Fix available 6.9 MediumSeptember 4, 2026
• valkey-io valkey valkey-io valkey Module Timer module.c moduleTimerHandler double free CVE-2026-82677 Fix available 4.8 MediumAugust 31, 2026
• valkey-io valkey valkey-io valkey Blocked-on-keys blocked.c handleClientsBlockedOnKey use after free CVE-2026-82631 Fix available 2.1 LowAugust 31, 2026
• valkey-io valkey Valkey: UAF in stream deserialization may lead to remote code execution CVE-2026-63639 Fix available 8.8 HighJuly 26, 2026
• valkey-io valkey Valkey: TLS pending-data processing use-after-free may allow remote code execution CVE-2026-56684 Fix available 7.5 HighJuly 26, 2026
• lfprojects valkey-bloom Remote DoS from malformed RESTORE command CVE-2026-21864 6.5 MediumFebruary 24, 2026
• lfprojects valkey, red hat enterprise linux 10, enterprise linux 9 +2 more Valkey has Pre-Authentication DOS from malformed RESP request CVE-2026-27623 Fix available 7.5 HighFebruary 23, 2026
• lfprojects valkey, red hat enterprise linux 10, enterprise linux 10.0 extended update support +2 more +4 more Malformed Valkey Cluster bus message can lead to Remote DoS CVE-2026-21863 Fix available 7.5 HighFebruary 23, 2026
• lfprojects valkey, red hat enterprise linux 10, enterprise linux 10.0 extended update support +1 more +3 more Valkey Affected by RESP Protocol Injection via Lua error_reply CVE-2025-67733 Public exploitFix available 8.5 HighFebruary 23, 2026
• valkey setDeferredReply in networking.c in Valkey through 8.1.1 has an integer underflow for prev->size ... CVE-2025-49112 Fix available 3.1 LowJune 2, 2025