valkey-io valkey
9 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-86227 | 9.0.0 ; 9.0.1 ; 9.0.2 ; … | valkey-io valkey kvstore.c kvstoreGetHashtable out-of-bounds | LOW 2.3 | 0.5 % | ||
| CVE-2026-85522 | 9.0 ; 9.1.0 ; 9.5.0 ; … | valkey-io valkey Slot Migration cluster_migrateslots.c createSlotImportJob out-of-bounds | MEDIUM 6.9 | 0.9 % | ||
| CVE-2026-82677 | 9.1.0 | valkey-io valkey Module Timer module.c moduleTimerHandler double free | MEDIUM 4.8 | 0.3 % | ||
| CVE-2026-82631 | 9.1.0 | valkey-io valkey Blocked-on-keys blocked.c handleClientsBlockedOnKey use after free | LOW 2.1 | 0.4 % | ||
| CVE-2026-63639 | < 7.2.14 ; >= 8.0.0, < 8.0.10 ; >= 8.1.0, < 8.1.9 ; … | Valkey: UAF in stream deserialization may lead to remote code execution | HIGH 8.8 | 0.9 % | ||
| CVE-2026-56684 | < 7.2.14 ; >= 8.0.0, < 8.0.10 ; >= 8.1.0, < 8.1.9 ; … | Valkey: TLS pending-data processing use-after-free may allow remote code execution | HIGH 7.5 | 0.5 % | ||
| CVE-2026-27623 | >= 9.0.0, < 9.0.3 | Valkey has Pre-Authentication DOS from malformed RESP request | HIGH 7.5 | 0.4 % | ||
| CVE-2026-21863 | < 7.2.12 ; >= 8.0.0, < 8.0.7 ; >= 8.1.0, < 8.1.6 ; … | Malformed Valkey Cluster bus message can lead to Remote DoS | HIGH 7.5 | 0.8 % | ||
| CVE-2025-67733 | < 7.2.12 ; >= 8.0.0, < 8.0.7 ; >= 8.1.0, < 8.1.6 ; … | Valkey Affected by RESP Protocol Injection via Lua error_reply | HIGH 8.5 | 0.6 % |