Executive brief
Valkey is an open-source distributed key-value database used for caching and real-time workloads. A double-free vulnerability in the module timer subsystem allows remote attackers to cause denial of service or potentially crash the Valkey server, impacting availability for applications and services that depend on it for caching or data storage.
Technical details
The vulnerability is a double-free condition in the moduleTimerHandler function within src/module.c of the Module Timer Subsystem in Valkey. The flaw can be triggered remotely without authentication requirements and results in memory corruption that can crash the process. A proof-of-concept has been publicly disclosed. The recommended fix is to deploy patch commit b349fe2821e3998534b1454c1b64a478daf8c6b7.
Affected products
- Valkey Valkey 9.1.0
Timeline
- 2026-08-31: disclosed: Publicly disclosed with PoC
- 2026-08-31: patched: Patch available: commit b349fe2821e3998534b1454c1b64a478daf8c6b7