EUVD-2026-60823Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable via RESTORE command; PR:L because Valkey authentication is required; AC:L since payload crafting is mechanically straightforward as documented by the vendor test.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when one consumer is deleted while another still references the shared NACK and potentially allowing remote code execution. This issue is fixed in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1.
AnalysisAI
Use-after-free in Valkey's RESTORE command allows a low-privileged remote attacker to potentially execute arbitrary code by supplying a crafted RDB stream payload that assigns a single Pending Entry List (PEL) NACK to multiple stream consumers. Valkey versions prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1 across all active release trains are affected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a Valkey client session authenticated with at least low-privilege credentials (CVSS PR:L) and with access to the RESTORE command - if ACLs block RESTORE for that user, exploitation is not possible. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 8.8 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately reflects the threat surface: the attack is network-reachable, mechanically straightforward once authenticated, and carries full CIA impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a low-privileged Valkey account issues a DUMP command on a stream with a consumer group, captures the RDB blob, then manually replaces the 16-byte big-endian message ID in the second consumer's PEL entry with the ID already held by the first consumer to create a shared NACK pointer. The attacker then issues RESTORE with the modified blob (bypassing CRC validation if needed via the debug flag or crafting a valid CRC). … |
| Remediation | Upgrade to a fixed release: Valkey 7.2.14 (https://github.com/valkey-io/valkey/releases/tag/7.2.14), 8.0.10 (https://github.com/valkey-io/valkey/releases/tag/8.0.10), 8.1.9 (https://github.com/valkey-io/valkey/releases/tag/8.1.9), 9.0.5 (https://github.com/valkey-io/valkey/releases/tag/9.0.5), or 9.1.1 (https://github.com/valkey-io/valkey/releases/tag/9.1.1). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Valkey deployments and identify instances running versions prior to 7.2.14 (7.2 line), 8.0.10 (8.0 line), 8.1.9 (8.1 line), 9.0.5 (9.0 line), and 9.1.1 (9.1 line). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Redis is an open source, in-memory database that persists on disk. Rated high severity (CVSS 7.5), this vulnerability is
Denial of service in Valkey 9.0.0 through 9.0.2 allows unauthenticated network attackers to crash the server by exploiti
Out-of-bounds read in Valkey clusterbus port processing allows network-adjacent attackers to crash affected systems by s
Use-after-free in Valkey's TLS connection handler allows an authenticated remote attacker to crash the server or potenti
Response-stream injection in Valkey (the Redis fork) lets an authenticated user abuse Lua scripting commands to smuggle
Same weakness CWE-416 – Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today