Executive brief
Valkey is an open-source, in-memory data store used as a cache and message broker in distributed systems. A use-after-free vulnerability in the blocked-on-keys subsystem could allow a remote attacker to crash the service or potentially execute code, impacting availability and data integrity for applications relying on Valkey for caching and real-time operations.
Technical details
The vulnerability is a use-after-free in the handleClientsBlockedOnKey function within src/blocked.c of Valkey's blocked-on-keys subsystem. The flaw occurs through memory manipulation that causes the application to reference freed memory. The attack is network-reachable and requires high complexity to exploit, though a public proof-of-concept has been released. An attacker can trigger a crash or potentially achieve code execution. A patch is available (commit b2fb0e13f5b4c8c2fb63dcfc2c37a067a0d6d20b) and should be applied immediately.
Affected products
- valkey-io Valkey 9.1.0
Timeline
- 2026-08-31: disclosed
- 2026-08-31: patched: Patch commit b2fb0e13f5b4c8c2fb63dcfc2c37a067a0d6d20b