CVE-2026-82677
Received Received - Intake

Double Free in Valkey Module Timer Subsystem

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: VulDB

Description
A vulnerability was determined in valkey-io valkey 9.1.0. Impacted is the function moduleTimerHandler of the file src/module.c of the component Module Timer Subsystem. This manipulation causes double free. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Patch name: b349fe2821e3998534b1454c1b64a478daf8c6b7. To fix this issue, it is recommended to deploy a patch.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-82677
EUVD
EUVD-2026-68457

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
valkey-io valkey 9.1.0
valkey-io valkey From 7.2 (inc) to 9.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-415 The product calls free() twice on the same memory address.
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a double-free vulnerability in Valkey 9.1.0 affecting the module timer subsystem. The issue occurs in the moduleTimerHandler function in src/module.c. When a module timer callback stops its own currently firing timer, the timer object is freed prematurely. The dispatcher then attempts to free the same object again, causing a double-free condition that leads to a server crash (denial of service).

Detection Guidance

To detect this vulnerability, monitor Valkey server crashes or AddressSanitizer reports indicating double-free errors in the module timer subsystem. Check for logs showing module timer callbacks stopping their own timers. Use Valkey's built-in test suites to validate timer behavior and ensure no crashes occur during self-stopping timer operations.

Impact Analysis

This vulnerability allows remote attackers to crash the Valkey server by triggering a double-free condition. This results in a denial of service where the server becomes unavailable, disrupting applications relying on Valkey for caching or real-time workloads. The attack does not require authentication and can be executed remotely.

Compliance Impact

This vulnerability causes a denial-of-service (DoS) condition via a double-free bug in the module timer subsystem, which could lead to service unavailability. For compliance standards like GDPR or HIPAA, which require data availability and integrity, such disruptions may violate availability requirements. However, the provided context does not explicitly link this vulnerability to compliance violations or data breaches.

Mitigation Strategies

Immediately upgrade Valkey to a patched version (7.2, 8.0, 8.1, 9.0, or 9.1) using the provided patch commit b349fe2821e3998534b1454c1b64a478daf8c6b7. If upgrading is not possible, disable untrusted module timers or restrict module usage until patched. Monitor server stability and apply the fix as soon as available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82677. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart