Log in Start free

Vulnerability · Published Aug 31, 2026 · Assigned by VulDB

CVE-2026-82677valkey-io valkey Module Timer module.c moduleTimerHandler double free

Low 2.4

In plain English

A low-severity double free in valkey from valkey-io. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)2.4Low
Exploit odds (30 days)0.3%top 78.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in valkey-io valkey 9.1.0. Impacted is the function moduleTimerHandler of the file src/module.c of the component Module Timer Subsystem. This manipulation causes double free. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Patch name: b349fe2821e3998534b1454c1b64a478daf8c6b7. To fix this issue, it is recommended to deploy a patch.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:14redictno fix listedDEBIAN-CVE-2026-82677
Debian:12redisno fix listedDEBIAN-CVE-2026-82677
Debian:13redisno fix listedDEBIAN-CVE-2026-82677
Debian:14redisno fix listedDEBIAN-CVE-2026-82677
Debian:13valkey8.1.1+dfsg1-3+deb13u3DEBIAN-CVE-2026-82677
Debian:14valkey9.1.2-1DEBIAN-CVE-2026-82677
Ubuntu:26.04:LTSvalkeyno fix listedUBUNTU-CVE-2026-82677
Ubuntu:26.10valkeyno fix listedUBUNTU-CVE-2026-82677

Affected products (as reported)

VendorProductVersions
valkey-io valkey 9.1.0

Weakness: CWE-415, CWE-119 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C

References