EUVD-2026-60822Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable TLS port justifies AV:N; race-condition timing requirement justifies AC:H; valid authentication is required so PR:L; full CIA:H reflects confirmed crash and plausible RCE impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's tlsProcessPendingData function iterates pending_list while an authenticated client can trigger CLIENT KILL, causing connTLSClose to delete the iterator's cached next node and producing a use-after-free that can crash the server or potentially allow remote code execution when TLS is enabled. This issue is fixed in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1.
AnalysisAI
Use-after-free in Valkey's TLS connection handler allows an authenticated remote attacker to crash the server or potentially achieve remote code execution on TLS-enabled deployments. The flaw exists across all Valkey branches prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, confirmed via GitHub security advisory GHSA-53mc-f3m3-99vh and EUVD-2026-60822. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | TLS must be explicitly enabled in Valkey's configuration (via tls-port and associated certificate settings), which is not the default in all deployments - instances running without TLS are entirely unaffected. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 7.5 with vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H reflects a serious but meaningfully constrained risk profile. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated low-privileged attacker holding a valid TLS session to Valkey issues a CLIENT KILL command targeting another active TLS connection at the precise moment tlsProcessPendingData is iterating the pending_list, freeing the iterator's cached next-node pointer. The resulting use-after-free crashes the server process or, if the attacker can additionally control heap layout through prior memory-grooming requests, redirects execution to attacker-controlled code. … |
| Remediation | The primary remediation is to upgrade to one of the patched releases - 7.2.14, 8.0.10, 8.1.9, 9.0.5, or 9.1.1 - all available at the official GitHub release pages (https://github.com/valkey-io/valkey/releases/tag/7.2.14, /8.0.10, /8.1.9, /9.0.5, /9.1.1). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Valkey instances running TLS and document their current versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Use-after-free in Valkey's RESTORE command allows a low-privileged remote attacker to potentially execute arbitrary code
Redis is an open source, in-memory database that persists on disk. Rated high severity (CVSS 7.5), this vulnerability is
Denial of service in Valkey 9.0.0 through 9.0.2 allows unauthenticated network attackers to crash the server by exploiti
Out-of-bounds read in Valkey clusterbus port processing allows network-adjacent attackers to crash affected systems by s
Response-stream injection in Valkey (the Redis fork) lets an authenticated user abuse Lua scripting commands to smuggle
Same weakness CWE-416 – Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today