Description
A security flaw has been discovered in valkey-io valkey 9.1.0. The affected element is the function handleClientsBlockedOnKey of the file src/blocked.c of the component Blocked-on-keys Subsystem. The manipulation results in use after free. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is described as difficult. The exploit has been released to the public and may be used for attacks. The patch is identified as b2fb0e13f5b4c8c2fb63dcfc2c37a067a0d6d20b. Applying a patch is advised to resolve this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| valkey-io | valkey | 9.1.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | redis | No fix yet | — |
| Debian 14 | valkey | 9.1.2-1 | — |
| Debian 13 | redis | No fix yet | — |
| Debian 13 | valkey | 8.1.1+dfsg1-3+deb13u3 | — |
| Debian 12 | redis | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | valkey | No fix yet | — |
| Ubuntu 26.04 LTS | valkey | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | valkey | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | valkey +5 | 9.0.6-0.1.hum1 | RHSA-2026:61884 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | valkey +1 | 9.0.6-1.amzn2023.0.1 | ALAS2023-2026-3091 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | valkey | 8.0.11-1 | — |
Advisories 2
- RHSA-2026:61884 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- ALAS2023-2026-3091 Moderate: valkey security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Sep 28, 2026
References
- VDB-397129 | valkey-io valkey Blocked-on-keys blocked.c handleClientsBlockedOnKey use after free vdb-entry technical-description
- VDB-397129 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- CVE-2026-82631 | CVE Analysis and Report third-party-advisory
- Submit #893793 | Valkey Project Valkey 9.1.0 Heap Use After Free third-party-advisory
- https://github.com/valkey-io/valkey/issues/4198 issue-tracking
- https://github.com/valkey-io/valkey/pull/4212 issue-tracking patch
- https://github.com/user-attachments/files/30111628/PoC.zip exploit
- https://github.com/valkey-io/valkey/commit/b2fb0e13f5b4c8c2fb63dcfc2c37a067a0d6d20b patch
- https://github.com/valkey-io/valkey/ product