Quick answers
- Is CVE-2026-82631 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-82631 being exploited in the wild.
- How severe is CVE-2026-82631?
- Low severity, with a CVSS score of 2.2, published 31 August 2026.
- Which products and versions are affected?
- valkey-io Valkey 9.1.0.
- Is there a fix for CVE-2026-82631?
- A patch was published on 2026-08-31: Patch commit b2fb0e13f5b4c8c2fb63dcfc2c37a067a0d6d20b Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-82631 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-82631?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a use-after-free in the handleClientsBlockedOnKey function within src/blocked.c of Valkey's blocked-on-keys subsystem. The flaw occurs through memory manipulation that causes the application to reference freed memory. The attack is network-reachable and requires high complexity to exploit, though a public proof-of-concept has been released. An attacker can trigger a crash or potentially achieve code execution. A patch is available (commit b2fb0e13f5b4c8c2fb63dcfc2c37a067a0d6d20b) and should be applied immediately.
Affected products
- valkey-io Valkey 9.1.0
Timeline
- 2026-08-31: disclosed
- 2026-08-31: patched: Patch commit b2fb0e13f5b4c8c2fb63dcfc2c37a067a0d6d20b