The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when one consumer is deleted while another still references the shared NACK and potentially allowing remote code execution. This issue is fixed in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade valkeyUpgrade valkey-devel | Oct 11, 2026 | Sep 8, 2026 |
| Amazon_linux_2023 | — | Upgrade valkey-debuginfoUpgrade valkeyUpgrade valkey-debugsourceUpgrade valkey-devel | Aug 19, 2026 | Aug 18, 2026 |
| Redhat_linux | — | Upgrade valkey-develUpgrade valkey-debugsourceUpgrade valkeyUpgrade valkey-debuginfo | Aug 26, 2026 | Aug 18, 2026 |
| Rocky_linux | — | Upgrade valkey-debugsourceUpgrade valkey-develUpgrade valkey-debuginfoUpgrade valkey | Sep 15, 2026 | Sep 9, 2026 |
| Ubuntu | — | Upgrade valkey-tools (Ubuntu Pro)Upgrade valkey-tools | Sep 17, 2026 | Sep 16, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub