# CVE-2026-56684: Valkey use-after-free in tlsProcessPendingData on CLIENT KILL

Source: https://junglewise.ai/threats/cve-2026-56684-valkey-use-after-free-in-tlsprocesspendingdata-on-client-kill  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-18. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-56684 · Severity: high · CVSS 7.5 · Published 2026-08-18

Valkey is a distributed key-value database used to store and retrieve data across multiple servers. When TLS encryption is enabled, an authenticated attacker can trigger a use-after-free memory vulnerability by sending a CLIENT KILL command while the server processes pending TLS data. This can cause the server to crash (denying service to all users) or potentially allow remote code execution.

## Quick answers

**Is CVE-2026-56684 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-56684 being exploited in the wild.

**How severe is CVE-2026-56684?** High severity, with a CVSS score of 7.5, published 18 August 2026.

**Which products and versions are affected?** Valkey Valkey before 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1.

**Is there a fix for CVE-2026-56684?** A patch was published on 2026-07-21. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-56684 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-56684?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A use-after-free vulnerability exists in the tlsProcessPendingData() function where a listIter iterates over pending_list while caching the next node reference. An authenticated client can trigger CLIENT KILL → freeClient → connTLSClose → listDelNode, which synchronously frees a connection including the cached next node, causing a subsequent listNext() call to dereference freed memory. The vulnerability requires TLS to be enabled and authentication to the server. An attacker can crash the server (authenticated remote DoS) or potentially achieve remote code execution via heap spray techniques. The fix, applied in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, changes the iteration logic to pop each connection from the list head before processing, eliminating the stale iterator reference.

## Affected products

- Valkey Valkey before 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1

## Timeline

- 2026-08-18: disclosed
- 2026-07-21: patched

## References

- [https://github.com/valkey-io/valkey/commit/7cd5bcb7575d750ec2de618db80da58680a10fe3](https://github.com/valkey-io/valkey/commit/7cd5bcb7575d750ec2de618db80da58680a10fe3)
- [https://github.com/valkey-io/valkey/pull/4234](https://github.com/valkey-io/valkey/pull/4234)