Executive brief
Valkey is a distributed key-value database used to store and retrieve data across multiple servers. When TLS encryption is enabled, an authenticated attacker can trigger a use-after-free memory vulnerability by sending a CLIENT KILL command while the server processes pending TLS data. This can cause the server to crash (denying service to all users) or potentially allow remote code execution.
Technical details
A use-after-free vulnerability exists in the tlsProcessPendingData() function where a listIter iterates over pending_list while caching the next node reference. An authenticated client can trigger CLIENT KILL → freeClient → connTLSClose → listDelNode, which synchronously frees a connection including the cached next node, causing a subsequent listNext() call to dereference freed memory. The vulnerability requires TLS to be enabled and authentication to the server. An attacker can crash the server (authenticated remote DoS) or potentially achieve remote code execution via heap spray techniques. The fix, applied in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, changes the iteration logic to pop each connection from the list head before processing, eliminating the stale iterator reference.
Affected products
- Valkey Valkey before 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1
Timeline
- 2026-08-18: disclosed
- 2026-07-21: patched