CVE-2026-82677
Fixed in a distro release EPSS <1%CVSS 2.4
A vulnerability was determined in valkey-io valkey 9.1.0. Impacted is the function moduleTimerHandler of the file src/module.c of the component Module Timer Subsystem. This manipulation causes double free. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Patch name: b349fe2821e3998534b1454c1b64a478daf8c6b7. To fix this issue, it is recommended to deploy a patch.
Products: valkey-io valkey
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian:12 | redis | no fix |
| Debian:13 | redis | no fix |
| Debian:13 | valkey | no fix |
| Debian:14 | redict | no fix |
| Debian:14 | redis | no fix |
| Debian:14 | valkey | 9.1.2-1 |
| Red Hat:hummingbird:1 | valkey | 0:9.0.6-0.1.hum1 |
| Red Hat:hummingbird:1 | valkey-compat-redis | 0:9.0.6-0.1.hum1 |
| Red Hat:hummingbird:1 | valkey-compat-redis-devel | 0:9.0.6-0.1.hum1 |
| Red Hat:hummingbird:1 | valkey-devel | 0:9.0.6-0.1.hum1 |
| Red Hat:hummingbird:1 | valkey-doc | 0:9.0.6-0.1.hum1 |
| Red Hat:hummingbird:1 | valkey-rdma | 0:9.0.6-0.1.hum1 |
| Ubuntu:26.04:LTS | valkey | no fix |
| Ubuntu:26.10 | valkey | no fix |
| Ubuntu:Pro:24.04:LTS | valkey | no fix |