What’s Vulnerable › Products

valkey-io valkey vulnerabilities

11 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 11 published in the last 12 months.

Check whether your valkey-io valkey version is affected

Latest valkey-io valkey vulnerabilities

• CVE-2026-86227 — valkey-io valkey kvstore.c kvstoreGetHashtable out-of-bounds (CVSS 3.1)
• CVE-2026-85522 — valkey-io valkey Slot Migration cluster_migrateslots.c createSlotImportJob out-of-bounds (CVSS 5.3)
• CVE-2026-82677 — valkey-io valkey Module Timer module.c moduleTimerHandler double free (CVSS 2.4)
• CVE-2026-82631 — valkey-io valkey Blocked-on-keys blocked.c handleClientsBlockedOnKey use after free (CVSS 2.2)
• CVE-2026-63639 — Valkey: UAF in stream deserialization may lead to remote code execution (CVSS 8.8)
• CVE-2026-56684 — Valkey: TLS pending-data processing use-after-free may allow remote code execution (CVSS 7.5)
• CVE-2026-27623 — Valkey has Pre-Authentication DOS from malformed RESP request (CVSS 7.5)
• CVE-2026-21863 — Malformed Valkey Cluster bus message can lead to Remote DoS (CVSS 7.5)
• CVE-2025-67733 — Valkey Affected by RESP Protocol Injection via Lua error_reply (CVSS 7.1)
• CVE-2025-49844 — Redis Lua Use-After-Free may lead to remote code execution (CVSS 9.9)
• CVE-2025-21605 — Redis DoS Vulnerability due to unlimited growth of output buffers abused by unauthenticated client (CVSS 7.5)