Log in Start free

Vulnerability · Published Aug 31, 2026 · Assigned by VulDB

CVE-2026-82631valkey-io valkey Blocked-on-keys blocked.c handleClientsBlockedOnKey use after free

Low 2.2

In plain English

A low-severity use-after-free in valkey from valkey-io. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)2.2Low
Exploit odds (30 days)0.4%top 70.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A security flaw has been discovered in valkey-io valkey 9.1.0. The affected element is the function handleClientsBlockedOnKey of the file src/blocked.c of the component Blocked-on-keys Subsystem. The manipulation results in use after free. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is described as difficult. The exploit has been released to the public and may be used for attacks. The patch is identified as b2fb0e13f5b4c8c2fb63dcfc2c37a067a0d6d20b. Applying a patch is advised to resolve this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:14redictno fix listedDEBIAN-CVE-2026-82631
Debian:12redisno fix listedDEBIAN-CVE-2026-82631
Debian:13redisno fix listedDEBIAN-CVE-2026-82631
Debian:14redisno fix listedDEBIAN-CVE-2026-82631
Debian:13valkey8.1.1+dfsg1-3+deb13u3DEBIAN-CVE-2026-82631
Debian:14valkey9.1.2-1DEBIAN-CVE-2026-82631
Ubuntu:26.04:LTSvalkeyno fix listedUBUNTU-CVE-2026-82631
Ubuntu:26.10valkeyno fix listedUBUNTU-CVE-2026-82631

Affected products (as reported)

VendorProductVersions
valkey-io valkey 9.1.0

Weakness: CWE-416, CWE-119 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C

References