CVE-2026-82677
CVE-2026-82677 · valkey-io valkey Module Timer module.c moduleTimerHandler double free
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A vulnerability was determined in valkey-io valkey 9.1.0. Impacted is the function moduleTimerHandler of the file src/module.c of the component Module Timer Subsystem. This manipulation causes double free. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Patch name: b349fe2821e3998534b1454c1b64a478daf8c6b7. To fix this issue, it is recommended to deploy a patch.
CVSS 4.8 · Medium · EPSS 0.5% · Fix available
- Published
- Updated
Affected products and versions
valkey
- Versions
- 9.1.0: Affected
No fix published
redict Debian:14
- Versions
- 7.3.0+ds-1
- 7.3.0+ds-2
- 7.3.0+ds-3
- 7.3.0+ds-3~bpo12+1
- 7.3.1+ds-1
- 7.3.2+ds-1
- 7.3.2+ds-1~bpo12+1
- 7.3.5+ds-1
- 7.3.5+ds-1~bpo12+1
- 7.3.6+ds-1
- 7.3.6+ds-1~bpo12+1
- 7.3.6+ds-1~bpo13+1
- 7.3.6+ds-2
- 7.3.6+ds-2~bpo12+1
- 7.3.6+ds-2~bpo13+1
- 7.3.6+ds-3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
redis Debian:12
- Versions
- 5:7.0.11-1
- 5:7.0.11-1+deb12u1
- 5:7.0.12-1
- 5:7.0.12-2
- 5:7.0.13-1
- 5:7.0.13-2
- 5:7.0.14-1
- 5:7.0.14-2
- 5:7.0.15-1
- 5:7.0.15-1~deb12u1
- 5:7.0.15-1~deb12u10
- 5:7.0.15-1~deb12u2
- 5:7.0.15-1~deb12u3
- 5:7.0.15-1~deb12u4
- 5:7.0.15-1~deb12u5
- 5:7.0.15-1~deb12u6
- 5:7.0.15-1~deb12u7
- 5:7.0.15-1~deb12u8
- 5:7.0.15-1~deb12u9
- 5:7.0.15-2
- 5:7.0.15-3
- 5:7.0.15-3.1
- 5:7.2-rc2-1
- 5:7.2-rc3-1
- 5:7.2.0-1
- 5:7.2.0-2
- 5:7.2.1-1
- 5:7.2.1-2
- 5:7.2.2-1
- 5:7.2.2-2
- 5:7.2.3-1
- 5:7.2.4-1
- 5:7.2.5-1
- 5:7.2.5-2
- 5:7.2.5-3
- 5:7.2~rc1-1
- 5:8.0.0-1
- 5:8.0.0-2
- 5:8.0.2-2
- 5:8.0.2-3
- 5:8.0.4-1
- 5:8.0.5-1
- 5:8.0.6-1
- 5:8.0.6-2
- 5:8.0.6-3
- 5:8.4.0-1
- 5:8.6.1-1
- 5:8.6.2-1
- 5:8.6.3-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
redis Debian:13
- Versions
- 5:8.0.2-3
- 5:8.0.2-3+deb13u1
- 5:8.0.2-3+deb13u2
- 5:8.0.4-1
- 5:8.0.5-1
- 5:8.0.6-1
- 5:8.0.6-2
- 5:8.0.6-3
- 5:8.4.0-1
- 5:8.6.1-1
- 5:8.6.2-1
- 5:8.6.3-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
redis Debian:14
- Versions
- 5:8.0.2-3
- 5:8.0.4-1
- 5:8.0.5-1
- 5:8.0.6-1
- 5:8.0.6-2
- 5:8.0.6-3
- 5:8.4.0-1
- 5:8.6.1-1
- 5:8.6.2-1
- 5:8.6.3-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
valkey Debian:13
- Versions
- 8.1.1+dfsg1-3
- 8.1.1+dfsg1-3+deb13u1
- 8.1.1+dfsg1-3+deb13u2
- 8.1.4+dfsg1-1
- 8.1.4+dfsg1-2
- 9.1.1-1
- 9.1.2-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
valkey Debian:14
- Versions
- 8.1.1+dfsg1-3
- 8.1.4+dfsg1-1
- 8.1.4+dfsg1-2
- 9.1.1-1
- Affected ranges
- ECOSYSTEM: < 9.1.2-1
Update to 9.1.2-1
valkey Ubuntu:Pro:24.04:LTS
- Versions
- 7.2.5+dfsg1-2ubuntu4~24.04.1
- 7.2.7+dfsg1-0ubuntu0.24.04.1
- 7.2.8+dfsg1-0ubuntu0.24.04.1
- 7.2.8+dfsg1-0ubuntu0.24.04.2
- 7.2.8+dfsg1-0ubuntu0.24.04.3
- 7.2.10+dfsg1-0ubuntu0.1
- 7.2.11+dfsg1-0ubuntu0.1
- 7.2.11+dfsg1-0ubuntu0.2
- 7.2.12+dfsg1-0ubuntu0.1
- 7.2.13+dfsg1-0ubuntu0.1
- 7.2.13+dfsg1-0ubuntu0.1+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
valkey Ubuntu:26.10
- Versions
- 9.0.3-0ubuntu2
- 9.0.4-0ubuntu1
- 9.1.1-0ubuntu2
- 9.1.2-0ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
valkey Ubuntu:26.04:LTS
- Versions
- 8.1.3+dfsg1-0ubuntu2
- 8.1.4+dfsg1-0ubuntu1
- 9.0.2-0ubuntu1
- 9.0.3-0ubuntu1
- 9.0.3-0ubuntu2
- 9.0.4-0ubuntu0.1
- 9.0.4-0ubuntu0.2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://vuldb.com/vuln/397172
- https://vuldb.com/vuln/397172/cti
- https://vuldb.com/cve/CVE-2026-82677
- https://vuldb.com/submit/893959
- https://github.com/valkey-io/valkey/issues/4200
- https://github.com/valkey-io/valkey/pull/4211
- https://github.com/user-attachments/files/30118801/PoC.zip
- https://github.com/valkey-io/valkey/commit/b349fe2821e3998534b1454c1b64a478daf8c6b7
- https://github.com/valkey-io/valkey/
- https://nvd.nist.gov/vuln/detail/CVE-2026-82677