CVE-2026-82677valkey-io valkey Module Timer module.c moduleTimerHandler double free

Beschreibung

A vulnerability was determined in valkey-io valkey 9.1.0. Impacted is the function moduleTimerHandler of the file src/module.c of the component Module Timer Subsystem. This manipulation causes double free. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Patch name: b349fe2821e3998534b1454c1b64a478daf8c6b7. To fix this issue, it is recommended to deploy a patch.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• VDB-397172 | valkey-io valkey Module Timer module.c moduleTimerHandler double free vdb-entrytechnical-description
• VDB-397172 | CTI Indicators (IOB, IOC, IOA) signaturepermissions-required
• CVE-2026-82677 | CVE Analysis and Report third-party-advisory
• Submit #893959 | Valkey Project Valkey 9.1.0 Double Free third-party-advisory
• https://github.com/valkey-io/valkey/issues/4200 issue-tracking
• https://github.com/valkey-io/valkey/pull/4211 issue-trackingpatch
• https://github.com/user-attachments/files/30118801/PoC.zip exploit
• https://github.com/valkey-io/valkey/commit/b349fe2821e3998534b1454c1b64a478daf8c6b7 patch
• https://github.com/valkey-io/valkey/ product