CVE-2026-63639 valkey-io CVE debrief

Who should care

Defenders responsible for Valkey deployments should assess exposure and prioritize patching to prevent potential remote code execution. This includes verifying inventory of Valkey deployments, monitoring for suspicious activity, and reviewing compensating controls for exposed systems.

Why it matters

CVE-2026-63639 is a high-severity vulnerability in Valkey that requires patching to prevent potential remote code execution.

• Potential remote code execution
• Need to verify Valkey deployment inventory
• Need to monitor for suspicious activity
• Patching required to prevent exploitation

Technical summary

The vulnerability exists in the RESTORE command of Valkey, a distributed key-value database. A malformed RDB stream payload can be used to assign one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, potentially leading to remote code execution. This issue has been fixed in Valkey versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1. Defenders should prioritize patching Valkey instances to prevent potential remote code execution. The vulnerability allows for remote code execution by assigning one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization.

Defensive priority

Defenders should prioritize patching Valkey instances to prevent potential remote code execution.

Recommended defensive actions

• Patch Valkey instances to versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, or 9.1.1
• Verify inventory of Valkey deployments
• Monitor for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source references provide details on the vulnerability and its fixes. However, the scope of affected deployments and potential impact require further verification. The vulnerability has been fixed in multiple versions of Valkey, including 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1. Defenders should verify inventory of Valkey deployments and monitor for suspicious activity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.