The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when one consumer is deleted while another still references the shared NACK and potentially allowing remote code execution. This issue is fixed in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade valkeyUpgrade valkey-devel | Oct 11, 2026 | Sep 8, 2026 |
| Amazon_linux_2023 | — | Upgrade valkeyUpgrade valkey-debugsourceUpgrade valkey-debuginfoUpgrade valkey-devel | Aug 19, 2026 | Aug 18, 2026 |
| Redhat_linux | — | Upgrade valkey-debugsourceUpgrade valkey-develUpgrade valkey-debuginfoUpgrade valkey | Aug 26, 2026 | Aug 18, 2026 |
| Rocky_linux | — | Upgrade valkeyUpgrade valkey-develUpgrade valkey-debugsourceUpgrade valkey-debuginfo | Sep 15, 2026 | Sep 9, 2026 |
| Ubuntu | — | Upgrade valkey-toolsUpgrade valkey-tools (Ubuntu Pro) | Sep 17, 2026 | Sep 16, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub