CVE-2026-82631: valkey-io valkey Blocked-on-keys blocked.c handleClientsBlockedOnKey use after free
A security flaw has been discovered in valkey-io valkey 9.1.0. The affected element is the function handleClientsBlockedOnKey of the file src/blocked.c of the component Blocked-on-keys Subsystem. The manipulation results in use after free. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is described as difficult. The exploit has been released to the public and may be used for attacks. The patch is identified as b2fb0e13f5b4c8c2fb63dcfc2c37a067a0d6d20b. Applying a patch is advised to resolve this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
valkey-io/valkey/Blocked-on-keys/blocked.c:handleClientsBlockedOnKey use after freeto a version that resolves this vulnerability.Patch b2fb0e13f5b4c8c2fb63dcfc2c37a067a0d6d20b - Compensating control
Because the attack may be performed from remote and exploitation is released publicly, restrict network access to the Valkey service (and any client connectivity paths) to only trusted hosts/IPs.
Event History
Frequently Asked Questions
Who can exploit this issue?
The attack can be performed remotely, but it requires high privileges and high attack complexity. Exploitation is described as difficult, although a public exploit has been released.
What is the operational impact?
The reported impact is limited to availability. Confidentiality and integrity are not affected according to the supplied severity vector.
What remediation is available?
Apply the patch identified as b2fb0e13f5b4c8c2fb63dcfc2c37a067a0d6d20b. The supplied data identifies valkey 9.1.0 as affected.