Description
A vulnerability was determined in valkey-io valkey 9.1.0. Impacted is the function moduleTimerHandler of the file src/module.c of the component Module Timer Subsystem. This manipulation causes double free. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Patch name: b349fe2821e3998534b1454c1b64a478daf8c6b7. To fix this issue, it is recommended to deploy a patch.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| valkey-io | valkey | 9.1.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | redis | No fix yet | — |
| Debian 14 | valkey | 9.1.2-1 | — |
| Debian 13 | redis | No fix yet | — |
| Debian 13 | valkey | 8.1.1+dfsg1-3+deb13u3 | — |
| Debian 12 | redis | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | valkey | No fix yet | — |
| Ubuntu 26.04 LTS | valkey | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | valkey | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | valkey +5 | 9.0.6-0.1.hum1 | RHSA-2026:61884 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | valkey +1 | 9.0.6-1.amzn2023.0.1 | ALAS2023-2026-3091 |
Advisories 2
- RHSA-2026:61884 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- ALAS2023-2026-3091 Moderate: valkey security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Sep 28, 2026
References
- VDB-397172 | valkey-io valkey Module Timer module.c moduleTimerHandler double free vdb-entry technical-description
- VDB-397172 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- CVE-2026-82677 | CVE Analysis and Report third-party-advisory
- Submit #893959 | Valkey Project Valkey 9.1.0 Double Free third-party-advisory
- https://github.com/valkey-io/valkey/issues/4200 issue-tracking
- https://github.com/valkey-io/valkey/pull/4211 issue-tracking patch
- https://github.com/user-attachments/files/30118801/PoC.zip exploit
- https://github.com/valkey-io/valkey/commit/b349fe2821e3998534b1454c1b64a478daf8c6b7 patch
- https://github.com/valkey-io/valkey/ product