Valkey CVE-2026-63639

Valkey (cpe:2.3:a:valkey-io:valkey) is an open-source, Redis-compatible distributed key-value store that serializes and deserializes database state using the RDB (Redis Database) binary format. The RESTORE command accepts an externally-supplied RDB blob and reconstructs in-memory objects from it, including stream consumer groups. Stream consumer groups maintain a Pending Entry List (PEL) - a radix tree of NACK structs that track unacknowledged messages. Each NACK struct contains a pointer back to exactly one owning consumer. The vulnerability (CWE-416: Use After Free) arises because the RDB deserialization path in rdb.c did not validate that a NACK was already assigned to a different consumer before assigning it again, allowing a malformed payload to create aliased pointers where two distinct consumer structs point to the same NACK. When the first consumer is subsequently freed (e.g., on consumer deletion), the NACK memory is released while the second consumer still holds a dangling pointer to it, corrupting heap metadata and enabling attacker-controlled memory writes.