---
id: CVE-2026-63639
title: Valkey is a distributed key-value database
summary: >-
  Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9,
  9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream
  payload that assigns one Pending Entry List NACK to multiple consumers during
  stream co…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-416
published: '2026-08-18'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T20:05:53.723'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-63639'
references:
  - url: >-
      https://github.com/valkey-io/valkey/commit/06bc7768fe609f2054e69ccedefe7628f5675da9
    label: security-advisories@github.com
  - url: >-
      https://github.com/valkey-io/valkey/commit/509cb3c74e8cbc9c0498ebe8b6c93dcd605e7271
    label: security-advisories@github.com
  - url: >-
      https://github.com/valkey-io/valkey/commit/98465eaffe3f95524a5046318bfbc4bdb9798291
    label: security-advisories@github.com
  - url: >-
      https://github.com/valkey-io/valkey/commit/e95911d4d65be8789fa3705f44d7ed1e65378445
    label: security-advisories@github.com
  - url: >-
      https://github.com/valkey-io/valkey/commit/f8d2027e8d4df790ac04974bf606408c8ea62778
    label: security-advisories@github.com
  - url: 'https://github.com/valkey-io/valkey/pull/4073'
    label: security-advisories@github.com
  - url: 'https://github.com/valkey-io/valkey/releases/tag/7.2.14'
    label: security-advisories@github.com
  - url: 'https://github.com/valkey-io/valkey/releases/tag/8.0.10'
    label: security-advisories@github.com
  - url: 'https://github.com/valkey-io/valkey/releases/tag/8.1.9'
    label: security-advisories@github.com
  - url: 'https://github.com/valkey-io/valkey/releases/tag/9.0.5'
    label: security-advisories@github.com
  - url: 'https://github.com/valkey-io/valkey/releases/tag/9.1.1'
    label: security-advisories@github.com
  - url: >-
      https://github.com/valkey-io/valkey/security/advisories/GHSA-mvcj-73cw-22m4
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.0117
epssPercentile: 0.66059
ingestedAt: '2026-09-18T20:51:25.629Z'
---

## Overview

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when one consumer is deleted while another still references the shared NACK and potentially allowing remote code execution. This issue is fixed in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.