Bug 2526233 (CVE-2026-82677) - CVE-2026-82677 valkey: Valkey: Denial of Service via double free in Module Timer subsystem
Summary: CVE-2026-82677 valkey: Valkey: Denial of Service via double free in Module Ti...
Keywords:
Status: NEW
Alias: CVE-2026-82677
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2533980 2533981
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-08-31 10:21 UTC by OSIDB Bzimport
Modified: 2026-09-15 16:02 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-08-31 10:21:28 UTC 
A vulnerability was determined in valkey-io valkey 9.1.0. Impacted is the function moduleTimerHandler of the file src/module.c of the component Module Timer Subsystem. This manipulation causes double free. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Patch name: b349fe2821e3998534b1454c1b64a478daf8c6b7. To fix this issue, it is recommended to deploy a patch.
Note You need to log in before you can comment on or make changes to this bug.