CVE-2026-56684

A flaw was found in Valkey. An authenticated client can trigger a CLIENT KILL command while the tlsProcessPendingData function iterates a pending list. This action causes connTLSClose to delete the iterator's cached next node, leading to a use-after-free vulnerability. This flaw, when Transport Layer Security (TLS) is enabled, may result in a server crash or potentially allow a remote attacker to achieve arbitrary code execution.

Red Hat has rated this vulnerability as Important rather than Critical because exploitation requires valid client authentication and applies only to environments with native TLS encryption enabled. In default configurations, native TLS listeners are not enabled, limiting exposure to deployments explicitly hardened for encrypted traffic. While triggering the memory corruption requires precise timing when closing connections, an authenticated user possessing connection termination privileges could induce an abnormal daemon termination or potentially execute arbitrary code.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Restrict network access to the Valkey instance to trusted clients and networks by configuring firewall rules to limit inbound connections to the Valkey service port. Ensure only authorized and authenticated clients can connect. If TLS is not strictly required, consider disabling it. These network restrictions will persist if the Valkey service is reloaded or restarted.