Is CVE-2026-82677 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82677 being exploited in the wild.

How severe is CVE-2026-82677?

Low severity, with a CVSS score of 2.4, published 31 August 2026.

Is there a fix for CVE-2026-82677?

A patch was published on 2026-08-31: Patch available: commit b349fe2821e3998534b1454c1b64a478daf8c6b7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-82677 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-82677?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82677: Valkey module timer handler double free

CVE-2026-82677 · Severity: low · CVSS 2.4 · Published 2026-08-31

Valkey is an open-source distributed key-value database used for caching and real-time workloads. A double-free vulnerability in the module timer subsystem allows remote attackers to cause denial of service or potentially crash the Valkey server, impacting availability for applications and services that depend on it for caching or data storage.

Quick answers

Is CVE-2026-82677 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82677 being exploited in the wild.
How severe is CVE-2026-82677?: Low severity, with a CVSS score of 2.4, published 31 August 2026.
Which products and versions are affected?: Valkey Valkey 9.1.0.
Is there a fix for CVE-2026-82677?: A patch was published on 2026-08-31: Patch available: commit b349fe2821e3998534b1454c1b64a478daf8c6b7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-82677 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-82677?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a double-free condition in the moduleTimerHandler function within src/module.c of the Module Timer Subsystem in Valkey. The flaw can be triggered remotely without authentication requirements and results in memory corruption that can crash the process. A proof-of-concept has been publicly disclosed. The recommended fix is to deploy patch commit b349fe2821e3998534b1454c1b64a478daf8c6b7.

Affected products

Valkey Valkey 9.1.0

Timeline

2026-08-31: disclosed: Publicly disclosed with PoC
2026-08-31: patched: Patch available: commit b349fe2821e3998534b1454c1b64a478daf8c6b7

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.