CVE-2026-63639

A flaw was found in Valkey, a distributed key-value database. A remote attacker could exploit a use-after-free vulnerability in the RESTORE command. This occurs when a malformed data stream is processed during stream deserialization, causing a shared resource to be improperly managed. If successfully exploited, this flaw could lead to remote code execution.

This vulnerability is rated as having an Important severity for Red Hat products because an authenticated network client can trigger memory corruption leading to potential arbitrary code execution within the Valkey service context. Although exploitation requires authorization to execute the RESTORE command against the database instance, standard deployments that expose database access to untrusted clients or shared services face significant compromise of confidentiality, integrity, and availability. Deployments that enforce strict access control lists or isolate Valkey instances to trusted internal infrastructure experience reduced exposure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, restrict network access to the Valkey instance to only trusted clients and networks. This limits an attacker's ability to send malformed RDB stream payloads to the RESTORE command. Implement firewall rules to block unauthorized access to the Valkey port.