Every CVE Search/ Get API key

CVE-2026-82631

valkey-io valkey Blocked-on-keys blocked.c handleClientsBlockedOnKey use after free

2.1 LowFix available

A security flaw has been discovered in valkey-io valkey 9.1.0. The affected element is the function handleClientsBlockedOnKey of the file src/blocked.c of the component Blocked-on-keys Subsystem. The manipulation results in use after free. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is described as difficult. The exploit has been released to the public and may be used for attacks. The patch is identified as b2fb0e13f5b4c8c2fb63dcfc2c37a067a0d6d20b. Applying a patch is advised to resolve this issue.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
High
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.36%Unchanged since Aug 31, 2026
90%50%10%1%

What each source reports

CVE List Score used 2.1

valkey-io valkey Blocked-on-keys blocked.c handleClientsBlockedOnKey use after free

A security flaw has been discovered in valkey-io valkey 9.1.0. The affected element is the function handleClientsBlockedOnKey of the file src/blocked.c of the component Blocked-on-keys Subsystem. The manipulation results in use after free. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is described as difficult. The exploit has been released to the public and may be used for attacks. The patch is identified as b2fb0e13f5b4c8c2fb63dcfc2c37a067a0d6d20b. Applying a patch is advised to resolve this issue.

Record
CVE-2026-82631
CVSS 4.0
2.1 LowCVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
CVSS 3.1
2.2 LowCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
CVSS 3.0
2.2 LowCVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
CVSS 2.0
1.7 AV:N/AC:H/Au:M/C:N/I:N/A:P/E:POC/RL:OF/RC:C
Weakness
CWE-416, CWE-119
Updated
2026-11-02
EUVDEUVD-2026-68393 2.1

A security flaw has been discovered in valkey-io valkey 9.1.0. The affected element is the function handleClientsBlockedOnKey of the file src/blocked.c of the component Blocked-on-keys Subsystem. The manipulation results in use after free. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is described as difficult. The exploit has been released to the public and may be used for attacks. The patch is identified as b2fb0e13f5b4c8c2fb63dcfc2c37a067a0d6d20b. Applying a patch is advised to resolve this issue.

Record
EUVD-2026-68393
CVSS 4.0
2.1 LowCVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Updated
2026-11-02
GitHub AdvisoriesGHSA-vxq6-76gw-j6q5 1.2

A security flaw has been discovered in valkey-io valkey 9.1.0. The affected element is the...

A security flaw has been discovered in valkey-io valkey 9.1.0. The affected element is the function handleClientsBlockedOnKey of the file src/blocked.c of the component Blocked-on-keys Subsystem. The manipulation results in use after free. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is described as difficult. The exploit has been released to the public and may be used for attacks. The patch is identified as b2fb0e13f5b4c8c2fb63dcfc2c37a067a0d6d20b. Applying a patch is advised to resolve this issue.

Record
GHSA-vxq6-76gw-j6q5
CVSS 4.0
1.2 LowCVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
2.2 LowCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-119
Updated
2026-11-02
NVD 1.2

A security flaw has been discovered in valkey-io valkey 9.1.0. The affected element is the function handleClientsBlockedOnKey of the file src/blocked.c of the component Blocked-on-keys Subsystem. The manipulation results in use after free. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is described as difficult. The exploit has been released to the public and may be used for attacks. The patch is identified as b2fb0e13f5b4c8c2fb63dcfc2c37a067a0d6d20b. Applying a patch is advised to resolve this issue.

Record
CVE-2026-82631
CVSS 4.0
1.2 LowCVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
2.2 LowCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L
CVSS 2.0
1.7 LowAV:N/AC:H/Au:M/C:N/I:N/A:P
Weakness
CWE-119, CWE-416
Updated
2026-11-02
OSVBELL-CVE-2026-82631 2.2
Record
BELL-CVE-2026-82631
CVSS 3.1
2.2 LowCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSV 1.2

valkey-io valkey Blocked-on-keys blocked.c handleClientsBlockedOnKey use after free

A security flaw has been discovered in valkey-io valkey 9.1.0. The affected element is the function handleClientsBlockedOnKey of the file src/blocked.c of the component Blocked-on-keys Subsystem. The manipulation results in use after free. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is described as difficult. The exploit has been released to the public and may be used for attacks. The patch is identified as b2fb0e13f5b4c8c2fb63dcfc2c37a067a0d6d20b. Applying a patch is advised to resolve this issue.

Record
CVE-2026-82631
CVSS 4.0
1.2 LowCVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Weakness
CWE-119, CWE-416
Updated
2026-11-02
Show 4 moreShow less
OSVDEBIAN-CVE-2026-82631 1.2

A security flaw has been discovered in valkey-io valkey 9.1.0. The affected element is the function handleClientsBlockedOnKey of the file src/blocked.c of the component Blocked-on-keys Subsystem. The manipulation results in use after free. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is described as difficult. The exploit has been released to the public and may be used for attacks. The patch is identified as b2fb0e13f5b4c8c2fb63dcfc2c37a067a0d6d20b. Applying a patch is advised to resolve this issue.

Record
DEBIAN-CVE-2026-82631
CVSS 4.0
1.2 LowCVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVRHSA-2026:61884 8.8

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:61884
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-82631 1.2

A security flaw has been discovered in valkey-io valkey 9.1.0. The affected element is the function handleClientsBlockedOnKey of the file src/blocked.c of the component Blocked-on-keys Subsystem. The manipulation results in use after free. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is described as difficult. The exploit has been released to the public and may be used for attacks. The patch is identified as b2fb0e13f5b4c8c2fb63dcfc2c37a067a0d6d20b. Applying a patch is advised to resolve this issue.

Record
UBUNTU-CVE-2026-82631
CVSS 4.0
1.2 LowCVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
CVSS 3.1
2.2 LowCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVAZL-98439 No score

CVE-2026-82631 affecting package valkey for versions less than 8.0.11-1

A security flaw has been discovered in valkey-io valkey 9.1.0. The affected element is the function handleClientsBlockedOnKey of the file src/blocked.c of the component Blocked-on-keys Subsystem. The manipulation results in use after free. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is described as difficult. The exploit has been released to the public and may be used for attacks. The patch is identified as b2fb0e13f5b4c8c2fb63dcfc2c37a067a0d6d20b. Applying a patch is advised to resolve this issue.

Record
AZL-98439
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
valkey
Azure Linux:3
 before 8.0.11-1
8.0.11-1
valkey
Alpaquita:25
 8.1.6-r0 up to 8.1.10-r0
8.1.10-r0
valkey
Alpaquita:stream
 9.0.3-r0 up to 9.0.6-r0
9.0.6-r0
redict
Debian:14
 All versions, plus listed versions
7.3.0+ds-17.3.0+ds-27.3.0+ds-37.3.0+ds-3~bpo12+17.3.1+ds-1
Show 11 moreShow less
7.3.2+ds-17.3.2+ds-1~bpo12+17.3.5+ds-17.3.5+ds-1~bpo12+17.3.6+ds-17.3.6+ds-1~bpo12+17.3.6+ds-1~bpo13+17.3.6+ds-27.3.6+ds-2~bpo12+17.3.6+ds-2~bpo13+17.3.6+ds-3
 None known
redis
Debian:12
 All versions, plus listed versions
5:7.0.11-15:7.0.11-1+deb12u15:7.0.12-15:7.0.12-25:7.0.13-1
Show 44 moreShow less
5:7.0.13-25:7.0.14-15:7.0.14-25:7.0.15-15:7.0.15-1~deb12u15:7.0.15-1~deb12u105:7.0.15-1~deb12u25:7.0.15-1~deb12u35:7.0.15-1~deb12u45:7.0.15-1~deb12u55:7.0.15-1~deb12u65:7.0.15-1~deb12u75:7.0.15-1~deb12u85:7.0.15-1~deb12u95:7.0.15-25:7.0.15-35:7.0.15-3.15:7.2-rc2-15:7.2-rc3-15:7.2.0-15:7.2.0-25:7.2.1-15:7.2.1-25:7.2.2-15:7.2.2-25:7.2.3-15:7.2.4-15:7.2.5-15:7.2.5-25:7.2.5-35:7.2~rc1-15:8.0.0-15:8.0.0-25:8.0.2-25:8.0.2-35:8.0.4-15:8.0.5-15:8.0.6-15:8.0.6-25:8.0.6-35:8.4.0-15:8.6.1-15:8.6.2-15:8.6.3-1
 None known
redis
Debian:13
 All versions, plus listed versions
5:8.0.2-35:8.0.2-3+deb13u15:8.0.2-3+deb13u25:8.0.2-3+deb13u35:8.0.4-1
Show 8 moreShow less
5:8.0.5-15:8.0.6-15:8.0.6-25:8.0.6-35:8.4.0-15:8.6.1-15:8.6.2-15:8.6.3-1
 None known
redis
Debian:14
 All versions, plus listed versions
5:8.0.2-35:8.0.4-15:8.0.5-15:8.0.6-15:8.0.6-2
Show 5 moreShow less
5:8.0.6-35:8.4.0-15:8.6.1-15:8.6.2-15:8.6.3-1
 None known
valkey
Debian:13
 before 8.1.1+dfsg1-3+deb13u3, plus listed versions
8.1.1+dfsg1-38.1.1+dfsg1-3+deb13u18.1.1+dfsg1-3+deb13u2
8.1.1+dfsg1-3+deb13u3
valkey
Debian:14
 before 9.1.2-1, plus listed versions
8.1.1+dfsg1-38.1.4+dfsg1-18.1.4+dfsg1-29.1.1-1
9.1.2-1
valkey
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:9.0.6-0.1.hum1
0:9.0.6-0.1.hum1
Show 8 moreShow less
Affected packages
PackageAffectedFixed
valkey-compat-redis
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:9.0.6-0.1.hum1
0:9.0.6-0.1.hum1
valkey-compat-redis-devel
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:9.0.6-0.1.hum1
0:9.0.6-0.1.hum1
valkey-devel
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:9.0.6-0.1.hum1
0:9.0.6-0.1.hum1
valkey-doc
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:9.0.6-0.1.hum1
0:9.0.6-0.1.hum1
valkey-rdma
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:9.0.6-0.1.hum1
0:9.0.6-0.1.hum1
valkey
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
7.2.5+dfsg1-2ubuntu4~24.04.17.2.7+dfsg1-0ubuntu0.24.04.17.2.8+dfsg1-0ubuntu0.24.04.17.2.8+dfsg1-0ubuntu0.24.04.27.2.8+dfsg1-0ubuntu0.24.04.3
Show 6 moreShow less
7.2.10+dfsg1-0ubuntu0.17.2.11+dfsg1-0ubuntu0.17.2.11+dfsg1-0ubuntu0.27.2.12+dfsg1-0ubuntu0.17.2.13+dfsg1-0ubuntu0.17.2.13+dfsg1-0ubuntu0.1+esm1
 None known
valkey
Ubuntu:26.10
 All versions, plus listed versions
9.0.3-0ubuntu29.0.4-0ubuntu19.1.1-0ubuntu29.1.2-0ubuntu1
 None known
valkey
Ubuntu:26.04:LTS
 All versions, plus listed versions
8.1.3+dfsg1-0ubuntu28.1.4+dfsg1-0ubuntu19.0.2-0ubuntu19.0.3-0ubuntu19.0.3-0ubuntu29.0.4-0ubuntu0.19.0.4-0ubuntu0.2
 None known

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-82631 is a low vulnerability (CVSS 2.1) in Valkey-io Valkey, published August 31, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.36%, the 29th percentile. Fixed in valkey 8.0.11-1.

References

Show 74 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open