CVE-2026-82631
Received Received - Intake

Use After Free in Valkey 9.1.0

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: VulDB

Description
A security flaw has been discovered in valkey-io valkey 9.1.0. The affected element is the function handleClientsBlockedOnKey of the file src/blocked.c of the component Blocked-on-keys Subsystem. The manipulation results in use after free. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is described as difficult. The exploit has been released to the public and may be used for attacks. The patch is identified as b2fb0e13f5b4c8c2fb63dcfc2c37a067a0d6d20b. Applying a patch is advised to resolve this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-82631
EUVD
EUVD-2026-68393

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
valkey-io valkey 9.1.0
valkey-io valkey to 9.1.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a use-after-free flaw in Valkey 9.1.0 affecting the handleClientsBlockedOnKey function in src/blocked.c. It occurs when serving blocked clients, where a list iterator caches a client pointer but another client is freed during processing, such as via module callbacks or CLIENT KILL. The freed client's memory is then accessed, causing a crash or potential code execution.

Detection Guidance

Detecting this vulnerability requires checking if your Valkey server version is older than 9.1. The vulnerability is present in versions prior to 9.1, not just 9.1.0. Run 'valkey-server --version' to check your version. If it shows a version below 9.1, your system is vulnerable.

Impact Analysis

This vulnerability can lead to denial-of-service attacks against the Valkey server, causing crashes or instability. Attackers may exploit it remotely to disrupt services, though the complexity is high and exploitability is difficult. It may also allow unauthorized access in some scenarios, depending on server configuration.

Compliance Impact

This vulnerability is a use-after-free issue in Valkey's blocked client handling, which could lead to denial of service (DoS) attacks. While it does not directly expose personal data, a DoS could disrupt systems handling regulated data, potentially violating availability requirements in GDPR and HIPAA. However, the CVE does not provide specific compliance impact details.

Mitigation Strategies

Immediately upgrade Valkey to version 9.1 or later to apply the patch. The fix is identified as commit b2fb0e13f5b4c8c2fb63dcfc2c37a067a0d6d20b. If upgrading is not possible, restrict access to the Valkey server to trusted networks only to reduce exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82631. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart